Overview

overview

10

Static

static

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

043d28836f...9f.exe

windows7_x64

10

043d28836f...9f.exe

windows10_x64

10

096fc162ed...c8.exe

windows7_x64

10

096fc162ed...c8.exe

windows10_x64

10

1ad787b5aa...62.exe

windows7_x64

10

1ad787b5aa...62.exe

windows10_x64

10

258cbb13ac...bd.exe

windows7_x64

10

258cbb13ac...bd.exe

windows10_x64

10

25d79c1a50...7f.exe

windows7_x64

10

25d79c1a50...7f.exe

windows10_x64

10

4d27dca0a1...ef.exe

windows7_x64

10

4d27dca0a1...ef.exe

windows10_x64

10

500e7e5c00...44.exe

windows7_x64

10

500e7e5c00...44.exe

windows10_x64

10

578a3a7a2b...b3.exe

windows7_x64

10

578a3a7a2b...b3.exe

windows10_x64

10

7dc7ca2414...84.exe

windows7_x64

10

7dc7ca2414...84.exe

windows10_x64

10

96c9fde298...34.exe

windows7_x64

10

96c9fde298...34.exe

windows10_x64

10

9c4880a98c...82.exe

windows7_x64

10

9c4880a98c...82.exe

windows10_x64

10

a1dad4a83d...c4.exe

windows7_x64

10

a1dad4a83d...c4.exe

windows10_x64

10

acf1b7d80f...e0.exe

windows7_x64

10

acf1b7d80f...e0.exe

windows10_x64

10

ca14b87b56...83.exe

windows7_x64

10

ca14b87b56...83.exe

windows10_x64

10

cbf31d825a...d2.exe

windows7_x64

8

cbf31d825a...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    179s
  • max time network
    179s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08-11-2021 10:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe

  • Size

    5.6MB

  • MD5

    5802bc4fd763cd759b7875e94f9f2eaf

  • SHA1

    91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a

  • SHA256

    cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2

  • SHA512

    91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a

Score
10/10
redlinesmokeloadersocelarschrisnewmedia25aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

ChrisNEW

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

media25

C2

91.121.67.60:23325

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 33 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • autoit_exe 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
      PID:2336
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2632
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:3884
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4848
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2604
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2520
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2308
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:2000
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1452
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1260
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1252
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1096
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:872
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:320
                        • C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
                          "C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1284
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3916
                            • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:2940
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1152
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2332
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:704
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1292
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3028
                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01d702368dbba.exe
                                  Tue01d702368dbba.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1936
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Tue0133c29150b.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1792
                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0133c29150b.exe
                                  Tue0133c29150b.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  PID:1620
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:364
                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01994ec7a792fea9.exe
                                  Tue01994ec7a792fea9.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:1400
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
                                    6⤵
                                      PID:6152
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
                                        7⤵
                                          PID:6400
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
                                        6⤵
                                          PID:6208
                                          • C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:6408
                                        • C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                                          C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                                          6⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          PID:6328
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                            7⤵
                                              PID:6432
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sfhhruv.vbs"
                                              7⤵
                                                PID:6244
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\
                                                  8⤵
                                                    PID:5952
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AG8AcAAtAHAAcgBvAGMAZQBzAHMAIAAtAEkAZAAgADYAMwAyADgAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGcAeQB0AGcAcAB2AC4AZQB4AGUAIgA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAiACAALQBGAG8AcgBjAGUA
                                                  7⤵
                                                    PID:596
                                                    • C:\Users\Admin\AppData\Local\Temp\rgytgpv.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\rgytgpv.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      PID:5304
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                                                        9⤵
                                                          PID:5012
                                                          • C:\Windows\system32\ipconfig.exe
                                                            "C:\Windows\system32\ipconfig.exe" /release
                                                            10⤵
                                                            • Gathers network information
                                                            PID:3924
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                          9⤵
                                                            PID:6168
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Tue017abac33187.exe
                                                  4⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:940
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue017abac33187.exe
                                                    Tue017abac33187.exe
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:2408
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue017abac33187.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue017abac33187.exe
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:4308
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe
                                                  4⤵
                                                    PID:1360
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue018f791563585c0f9.exe
                                                      Tue018f791563585c0f9.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:3144
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe
                                                    4⤵
                                                      PID:2132
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01bf08f313b912.exe
                                                        Tue01bf08f313b912.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Drops Chrome extension
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3600
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                          6⤵
                                                            PID:4900
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              7⤵
                                                                PID:2692
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im chrome.exe
                                                                7⤵
                                                                • Kills process with taskkill
                                                                PID:5340
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                              6⤵
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:1216
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffbd64f4f50,0x7ffbd64f4f60,0x7ffbd64f4f70
                                                                7⤵
                                                                  PID:4588
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1696 /prefetch:8
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:4132
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
                                                                  7⤵
                                                                    PID:1320
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:8
                                                                    7⤵
                                                                      PID:5228
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
                                                                      7⤵
                                                                        PID:1764
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
                                                                        7⤵
                                                                          PID:592
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                                                                          7⤵
                                                                            PID:1888
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4436 /prefetch:8
                                                                            7⤵
                                                                              PID:6164
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
                                                                              7⤵
                                                                                PID:6948
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
                                                                                7⤵
                                                                                  PID:7108
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
                                                                                  7⤵
                                                                                    PID:7128
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:8
                                                                                    7⤵
                                                                                      PID:5076
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
                                                                                      7⤵
                                                                                        PID:2648
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
                                                                                        7⤵
                                                                                          PID:6964
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:8
                                                                                          7⤵
                                                                                            PID:4768
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4360 /prefetch:8
                                                                                            7⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3208
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
                                                                                            7⤵
                                                                                              PID:6236
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:8
                                                                                              7⤵
                                                                                                PID:4208
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                                                                                                7⤵
                                                                                                  PID:6460
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                                                                                                  7⤵
                                                                                                    PID:7028
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
                                                                                                    7⤵
                                                                                                      PID:4864
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
                                                                                                      7⤵
                                                                                                        PID:5036
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 /prefetch:8
                                                                                                        7⤵
                                                                                                          PID:4932
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,8064496433291117035,8167616252192003568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
                                                                                                          7⤵
                                                                                                            PID:5880
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe
                                                                                                      4⤵
                                                                                                        PID:1784
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01de2411919659f09.exe
                                                                                                          Tue01de2411919659f09.exe
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          PID:2140
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01de2411919659f09.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01de2411919659f09.exe
                                                                                                            6⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4332
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe
                                                                                                        4⤵
                                                                                                          PID:3520
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01bba8b80fa4.exe
                                                                                                            Tue01bba8b80fa4.exe
                                                                                                            5⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1164
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe
                                                                                                          4⤵
                                                                                                            PID:1496
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0121ab289cd9a.exe
                                                                                                              Tue0121ab289cd9a.exe
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3280
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c Tue0105f10596.exe
                                                                                                            4⤵
                                                                                                              PID:3172
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0105f10596.exe
                                                                                                                Tue0105f10596.exe
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks computer location settings
                                                                                                                • Drops Chrome extension
                                                                                                                PID:2760
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 1716
                                                                                                                  6⤵
                                                                                                                  • Program crash
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3940
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe
                                                                                                              4⤵
                                                                                                                PID:2640
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Tue0195119235.exe
                                                                                                                4⤵
                                                                                                                  PID:2008
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe
                                                                                                                  4⤵
                                                                                                                    PID:4052
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone
                                                                                                                    4⤵
                                                                                                                      PID:1408
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe
                                                                                                                      4⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1344
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe
                                                                                                                      4⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3440
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 620
                                                                                                                      4⤵
                                                                                                                      • Program crash
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2972
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01c451610f4a.exe
                                                                                                                Tue01c451610f4a.exe
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                PID:2148
                                                                                                                • C:\Users\Public\run.exe
                                                                                                                  C:\Users\Public\run.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4660
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                    3⤵
                                                                                                                      PID:1240
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\my.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\my.exe"
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2868
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 268
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                      • Program crash
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:5032
                                                                                                                  • C:\Users\Public\run2.exe
                                                                                                                    C:\Users\Public\run2.exe
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Checks computer location settings
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:4728
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue010769fc7f9829.exe
                                                                                                                  Tue010769fc7f9829.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4008
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0138d4026db6d813e.exe
                                                                                                                  Tue0138d4026db6d813e.exe /mixone
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:2084
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 660
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4680
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 676
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4848
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 632
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4964
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 672
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3208
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 940
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4328
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 928
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:5936
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1108
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                    • Program crash
                                                                                                                    PID:6016
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01e8898e0d1fce4.exe
                                                                                                                  Tue01e8898e0d1fce4.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3192
                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                    "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
                                                                                                                    2⤵
                                                                                                                      PID:4168
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-2HGST.tmp\Tue01d702368dbba.tmp
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-2HGST.tmp\Tue01d702368dbba.tmp" /SL5="$301E6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01d702368dbba.exe"
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:3572
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01d702368dbba.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01d702368dbba.exe" /SILENT
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3128
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0195119235.exe
                                                                                                                    Tue0195119235.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:3568
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0195119235.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue0195119235.exe" -u
                                                                                                                      2⤵
                                                                                                                        PID:4132
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue018bc5c5a0a3d4.exe
                                                                                                                      Tue018bc5c5a0a3d4.exe
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:3956
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-PNVJC.tmp\Tue01d702368dbba.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-PNVJC.tmp\Tue01d702368dbba.tmp" /SL5="$10202,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01d702368dbba.exe" /SILENT
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:4144
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "" == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\7zSC4F28D46\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"
                                                                                                                      1⤵
                                                                                                                        PID:4412
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe
                                                                                                                          ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv
                                                                                                                          2⤵
                                                                                                                            PID:4856
                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                              "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
                                                                                                                              3⤵
                                                                                                                                PID:5028
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"
                                                                                                                                  4⤵
                                                                                                                                    PID:3852
                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                  "C:\Windows\System32\mshta.exe" VBScrIPT: cLose ( creATeoBjECt ( "WscriPT.shELL" ). ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * " , 0 , True ) )
                                                                                                                                  3⤵
                                                                                                                                    PID:3628
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q *
                                                                                                                                      4⤵
                                                                                                                                        PID:912
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                                                          5⤵
                                                                                                                                            PID:2692
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"
                                                                                                                                            5⤵
                                                                                                                                              PID:1296
                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                              msiexec.exe -y ..\32AZBxCS.EP
                                                                                                                                              5⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:5576
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        taskkill /f /IM "Tue01e8898e0d1fce4.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:4964
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:4972
                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      PID:2208
                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                      1⤵
                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                      PID:5068
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                        2⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Modifies registry class
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4780
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:5544
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:5836
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:4984
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:5100
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:4856
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1167.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1167.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4444
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                        PID:6100

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • memory/320-555-0x000001FD9E0A0000-0x000001FD9E112000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/872-585-0x000001A5D4C50000-0x000001A5D4CC2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/1096-590-0x0000020106A40000-0x0000020106AB2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/1164-334-0x0000000002F30000-0x0000000002F59000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      164KB

                                                                                                                                      Download

                                                                                                                                    • memory/1164-336-0x0000000004A90000-0x0000000004ADA000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      296KB

                                                                                                                                      Download

                                                                                                                                    • memory/1164-341-0x0000000000400000-0x0000000002F1B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.1MB

                                                                                                                                      Download

                                                                                                                                    • memory/1240-474-0x0000000008920000-0x0000000008F26000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/1252-609-0x0000019B50010000-0x0000019B50082000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/1260-608-0x0000014102B70000-0x0000014102BE2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-203-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-277-0x0000000008060000-0x0000000008061000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-188-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-392-0x0000000005003000-0x0000000005004000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-207-0x0000000007670000-0x0000000007671000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-199-0x0000000005002000-0x0000000005003000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-294-0x0000000007D40000-0x0000000007D41000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-301-0x00000000089C0000-0x00000000089C1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-166-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-171-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-267-0x0000000007CD0000-0x0000000007CD1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1292-367-0x000000007EB10000-0x000000007EB11000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1400-382-0x000000001BD30000-0x000000001BD32000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/1400-183-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1400-1214-0x000000001BD32000-0x000000001BD34000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/1400-1215-0x000000001BD34000-0x000000001BD35000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1452-604-0x0000019E3E0A0000-0x0000019E3E112000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/1620-333-0x0000000002F00000-0x000000000304A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.3MB

                                                                                                                                      Download

                                                                                                                                    • memory/1620-332-0x0000000002F00000-0x000000000304A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.3MB

                                                                                                                                      Download

                                                                                                                                    • memory/1620-335-0x0000000000400000-0x0000000002EFA000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      43.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/1936-194-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      80KB

                                                                                                                                      Download

                                                                                                                                    • memory/2000-607-0x00000202B4F20000-0x00000202B4F92000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2084-345-0x0000000000810000-0x000000000085C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                      Download

                                                                                                                                    • memory/2084-346-0x0000000000400000-0x000000000058E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.6MB

                                                                                                                                      Download

                                                                                                                                    • memory/2140-240-0x0000000000A20000-0x0000000000A21000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2140-252-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2308-588-0x00000172DC810000-0x00000172DC882000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-389-0x0000000000AC3000-0x0000000000AC4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-170-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-205-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-271-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-206-0x0000000000AC2000-0x0000000000AC3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-165-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-269-0x0000000006E20000-0x0000000006E21000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2332-364-0x000000007EC60000-0x000000007EC61000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2336-584-0x00000175DE450000-0x00000175DE4C2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2408-255-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2408-272-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2408-230-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2408-249-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2408-241-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/2520-562-0x00000211C3780000-0x00000211C37F2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2604-610-0x000001C561270000-0x000001C5612E2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2632-606-0x000001A207B10000-0x000001A207B82000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/2760-470-0x00000000053F0000-0x000000000553C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.3MB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-144-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      152KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      100KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      572KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      572KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-143-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-139-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      572KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      100KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-147-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      100KB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      Download

                                                                                                                                    • memory/2940-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      100KB

                                                                                                                                      Download

                                                                                                                                    • memory/3040-394-0x0000000000F10000-0x0000000000F26000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      88KB

                                                                                                                                      Download

                                                                                                                                    • memory/3128-266-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      80KB

                                                                                                                                      Download

                                                                                                                                    • memory/3144-689-0x0000000005BF0000-0x0000000005D3C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.3MB

                                                                                                                                      Download

                                                                                                                                    • memory/3192-231-0x0000000002320000-0x0000000002321000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3192-227-0x0000000002320000-0x0000000002321000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3572-250-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3884-548-0x000001EA50D20000-0x000001EA50D6D000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      308KB

                                                                                                                                      Download

                                                                                                                                    • memory/3884-558-0x000001EA51090000-0x000001EA51102000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/3956-245-0x0000000000940000-0x0000000000941000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3956-254-0x000000001B2E0000-0x000000001B2E2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/3956-214-0x0000000000500000-0x0000000000501000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4008-213-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4008-236-0x000000001B740000-0x000000001B742000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/4144-275-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-298-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-280-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-295-0x00000000023B0000-0x00000000023B1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-292-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-306-0x0000000004870000-0x0000000004871000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4308-309-0x0000000004870000-0x0000000004E76000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/4332-281-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4332-310-0x00000000050E0000-0x00000000056E6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/4780-540-0x00000000043C6000-0x00000000044C7000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/4780-543-0x0000000004280000-0x00000000042DD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      372KB

                                                                                                                                      Download

                                                                                                                                    • memory/4848-923-0x00000201C91C0000-0x00000201C91DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      108KB

                                                                                                                                      Download

                                                                                                                                    • memory/4848-552-0x00000201C9300000-0x00000201C9372000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      456KB

                                                                                                                                      Download

                                                                                                                                    • memory/4848-926-0x00000201CBA00000-0x00000201CBB05000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.0MB

                                                                                                                                      Download

                                                                                                                                    • memory/5576-623-0x00000000052A0000-0x000000000534C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      688KB

                                                                                                                                      Download

                                                                                                                                    • memory/5576-622-0x0000000005140000-0x00000000051ED000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      692KB

                                                                                                                                      Download

                                                                                                                                    • memory/6400-1241-0x000002EEDDED0000-0x000002EEDDED2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/6400-1243-0x000002EEDDED3000-0x000002EEDDED5000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8KB

                                                                                                                                      Download

                                                                                                                                    • memory/6408-1216-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      192KB

                                                                                                                                      Download

                                                                                                                                    • memory/6408-1238-0x0000000000400000-0x0000000001036000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      12.2MB

                                                                                                                                      Download

                                                                                                                                    • memory/6408-1240-0x0000000005690000-0x0000000005691000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/6408-1242-0x0000000005692000-0x0000000005693000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download