Overview

overview

10

Static

static

1

RedBooster-Setup.exe

windows10-2004-x64

10

RedBooster-Setup.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    70s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/07/2026, 02:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RedBooster-Setup.exe
  • Size 65.1MB
  • Sample260712-dcffvsb18r
  • SHA256 984e2f2b664ebd0b4cfb21b00ebb86c0107da1518cbb933f1678b377552370ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

    Using powershell.exe command.

    execution
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 58 IoCs
  • Executes dropped EXE 9 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 20 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Loads dropped DLL 26 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Users\Admin\AppData\Local\Temp\is-YRJFMM3AJW.tmp\RedBooster-Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-YRJFMM3AJW.tmp\RedBooster-Setup.tmp" /SL5="$402DC,66094623,973824,C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM RedBooster.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5376
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM LibreHardwareMonitor.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5776
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM PresentMon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:456
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM rbframegen.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Users\Admin\AppData\Local\Temp\is-QNN4CUB383.tmp\windowsdesktop-runtime-8-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-QNN4CUB383.tmp\windowsdesktop-runtime-8-x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Windows\Temp\{7CB7DF98-C62D-4E54-BA85-1C3321B891E3}\.cr\windowsdesktop-runtime-8-x64.exe
          "C:\Windows\Temp\{7CB7DF98-C62D-4E54-BA85-1C3321B891E3}\.cr\windowsdesktop-runtime-8-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-QNN4CUB383.tmp\windowsdesktop-runtime-8-x64.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5208
          • C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\.be\windowsdesktop-runtime-8.0.28-win-x64.exe
            "C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\.be\windowsdesktop-runtime-8.0.28-win-x64.exe" -q -burn.elevated BurnPipe.{285C6B92-C35C-4AF4-A64A-874EC513E773} {97B19388-CA26-40E7-8C76-50339200141A} 5208
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3660
            • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
              "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={7644bebe-5a2f-4e49-91b7-fdd90f230fa5} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{08381809-858B-4416-B549-912AF5DF3335} {8DAEE2EC-FE46-451B-A7D3-0870581286A4} 3660
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:724
              • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={7644bebe-5a2f-4e49-91b7-fdd90f230fa5} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{08381809-858B-4416-B549-912AF5DF3335} {8DAEE2EC-FE46-451B-A7D3-0870581286A4} 3660
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4856
                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{34190274-A4BB-4563-A53B-C3AC7CDF676A} {37DB7D34-703E-494A-A07D-F528AD29ADA6} 4856
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:6556
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D6896A71E723F1CB88BD167E507DCD4C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3304
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 76A405CC39C5D1C6A1E5DD6CF1F2BE5D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5844
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CADC3976E54F0B65A81C092B6D784EC3
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4720
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F1B0050CEA2D2F87895A686401027519
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:6608
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C50E2B49E5E81EAED89DE5F7B9147250
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3812
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B5C37F610D461C7077A3D69B7256B538
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:6900
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 09C757752E09B3039FC746874BAB7802
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:7048
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9467BA5C3C9437CC4EFB6BFBD268CC82
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:116
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9CE6FE123713A4FBBD30B5970A408E7D
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 136849AA77339582138EF77A6439069B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:6524
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5C92E1FD4F3A86B1B984EAE80E092259
      2⤵
        PID:3412
    • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
      "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
        "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
          "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211.log" /install
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
            "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -q -burn.elevated BurnPipe.{5A7CB1E9-D823-43E0-81F1-17EEED41F2F6} {E5493DA6-9886-45C5-869F-0A0FF00EF3BE} 2980
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5924
            • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
              "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={7644bebe-5a2f-4e49-91b7-fdd90f230fa5} -burn.filehandle.self=984 -burn.embedded BurnPipe.{219B758D-C80D-47CA-9DA8-B6D13BA903AD} {D44199F7-15FA-4EFE-B65F-C2B9E6BF8B33} 5924
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5980
              • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={7644bebe-5a2f-4e49-91b7-fdd90f230fa5} -burn.filehandle.self=984 -burn.embedded BurnPipe.{219B758D-C80D-47CA-9DA8-B6D13BA903AD} {D44199F7-15FA-4EFE-B65F-C2B9E6BF8B33} 5924
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5608
                • C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
                  "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{2D7567F2-5F28-439E-9A9B-9C830DF06214} {18A201EB-0ADF-4779-BAC8-418095E5B032} 5608
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:6324
    • C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe
      "C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe"
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -NoLogo -Command " [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 $ErrorActionPreference='Continue' $ProgressPreference='SilentlyContinue' while ($true) { $line = [Console]::In.ReadLine() if ($null -eq $line) { break } if ($line.Length -eq 0) { continue } $p = $line.Split(':', 2) $id = $p[0] $script = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p[1])) $err = '' try { # Collect the script's output into an array FIRST, then iterate it. Piping # the scriptblock straight into a live \"| ForEach-Object\" breaks any command # that auto-loads its module mid-pipeline (e.g. Get-PhysicalDisk throws # \"MoveNext / Invalid property\" and silently drops all output). Collecting to # @(...) runs the module load to completion before we enumerate. $items = @(& ([scriptblock]::Create($script)) 2>&1) foreach ($item in $items) { if ($item -is [System.Management.Automation.ErrorRecord]) { $err += ($item.ToString() + [Environment]::NewLine) } elseif ($item -is [string]) { [Console]::Out.WriteLine($item) } else { [Console]::Out.WriteLine((($item | Out-String -Width 100000).TrimEnd())) } } } catch { $err += ($_.Exception.Message + [Environment]::NewLine) } $code = if ($err) { 1 } else { 0 } [Console]::Out.WriteLine(\"<<<RBERR:$($id)>>>\") [Console]::Out.Write($err) [Console]::Out.WriteLine(\"<<<RBDONE:$($id):$($code)>>>\") [Console]::Out.Flush() }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4448.3904.4662519198617479142
        2⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffc034db078,0x7ffc034db084,0x7ffc034db090
          3⤵
            PID:4396
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
            3⤵
              PID:1016
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
              3⤵
                PID:2372
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
                3⤵
                  PID:5928
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3684,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
                  3⤵
                    PID:1476
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
                    3⤵
                      PID:4220
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4716,i,5716126625950475942,17990437476732129321,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
                      3⤵
                        PID:6184
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $ProgressPreference='SilentlyContinue' # 1) Re-register App Installer if it's installed but not registered for this user (instant, common case). Get-AppxPackage Microsoft.DesktopAppInstaller | ForEach-Object { Add-AppxPackage -DisableDevelopmentMode -Register (\"$($_.InstallLocation)\AppXManifest.xml\") } # 2) Still missing -> download + install the official App Installer (winget) bundle + its VCLibs dependency. if (-not (Get-Command winget -ErrorAction SilentlyContinue)) { $tmp = Join-Path $env:TEMP 'rb_winget'; New-Item -ItemType Directory -Force -Path $tmp | Out-Null try { $vc = Join-Path $tmp 'vclibs.appx'; Invoke-WebRequest 'https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx' -OutFile $vc -UseBasicParsing; Add-AppxPackage $vc } catch {} try { $b = Join-Path $tmp 'winget.msixbundle'; Invoke-WebRequest 'https://aka.ms/getwinget' -OutFile $b -UseBasicParsing; Add-AppxPackage $b } catch {} }"
                      2⤵
                      • Badlisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4404
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command $null
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5680
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1684
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2900
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "$os=Get-CimInstance Win32_OperatingSystem $cpu=(Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average $t=$os.TotalVisibleMemorySize; $f=$os.FreePhysicalMemory [pscustomobject]@{ cpuPct=[int]$cpu; ramPct=[int]((($t-$f)/$t)*100); ramUsedGb=[math]::Round(($t-$f)/1MB,1); ramTotalGb=[math]::Round($t/1MB,1) } | ConvertTo-Json -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5364
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4856
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1740
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2432
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4640
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6140
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object CurrentTemperature | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4540
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "@(Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { $rc = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue [pscustomobject]@{ index=[int]$_.DeviceId; temp=[int]$rc.Temperature; wear=[int]$rc.Wear; readErrors=[int]$rc.ReadErrorsTotal } }) | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2900
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "$os=Get-CimInstance Win32_OperatingSystem $cpu=(Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average $t=$os.TotalVisibleMemorySize; $f=$os.FreePhysicalMemory [pscustomobject]@{ cpuPct=[int]$cpu; ramPct=[int]((($t-$f)/$t)*100); ramUsedGb=[math]::Round(($t-$f)/1MB,1); ramTotalGb=[math]::Round($t/1MB,1) } | ConvertTo-Json -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6196
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6360
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6600
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6704
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6716
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:6540
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "@(Get-CimInstance Win32_DiskDrive -ErrorAction SilentlyContinue | ForEach-Object { [pscustomobject]@{ index=[int]$_.Index; model=[string]$_.Model; media=[string]$_.MediaType; bus=[string]$_.InterfaceType; health=[string]$_.Status; sizeGb=[math]::Round($_.Size/1GB,0); tempC=0; wear=0; readErrors=0 } }) | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:6588
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:5500
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:1312
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:5828
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "@(Get-CimInstance Win32_DiskDrive -ErrorAction SilentlyContinue | ForEach-Object { [pscustomobject]@{ index=[int]$_.Index; model=[string]$_.Model; media=[string]$_.MediaType; bus=[string]$_.InterfaceType; health=[string]$_.Status; sizeGb=[math]::Round($_.Size/1GB,0); tempC=0; wear=0; readErrors=0 } }) | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:2040
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -NonInteractive -Command "@(Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { $rc = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue [pscustomobject]@{ index=[int]$_.DeviceId; temp=[int]$rc.Temperature; wear=[int]$rc.Wear; readErrors=[int]$rc.ReadErrorsTotal } }) | ConvertTo-Json -Depth 3 -Compress"
                      2⤵
                      • Hide Artifacts: Ignore Process Interrupts
                      PID:6608
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:4720
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -NonInteractive -Command "@(Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { $rc = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue [pscustomobject]@{ index=[int]$_.DeviceId; temp=[int]$rc.Temperature; wear=[int]$rc.Wear; readErrors=[int]$rc.ReadErrorsTotal } }) | ConvertTo-Json -Depth 3 -Compress"
                        2⤵
                        • Hide Artifacts: Ignore Process Interrupts
                        PID:2988
                    • C:\Windows\system32\taskmgr.exe
                      "C:\Windows\system32\taskmgr.exe" /4
                      1⤵
                      • Checks SCSI registry key(s)
                      • Checks processor information in registry
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:6932
                    • C:\Windows\system32\backgroundTaskHost.exe
                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                      1⤵
                        PID:6900

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e58465e.rbs
                            • Path C:\Config.Msi\e58465e.rbs
                            • Size 48KB
                            • SHA256 6bbbc21ef96194cf638c6eb4e5872da59844ece3d9ad539deb5c72cb708d5f47
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e584662.rbs
                            • Path C:\Config.Msi\e584662.rbs
                            • Size 3KB
                            • SHA256 dce87d2036ea5fdaed42595ce07f65cf6f49675a0f41060a5ed29bb70d48ce5c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e584666.rbs
                            • Path C:\Config.Msi\e584666.rbs
                            • Size 9KB
                            • SHA256 e43c775524618bfc69bca5c8ed6de58fecd1b3b84f7e9b164f986b5d84ef04e9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e58466a.rbs
                            • Path C:\Config.Msi\e58466a.rbs
                            • Size 3KB
                            • SHA256 2671c925d42b8ef27de2ee5d34ced5b9c8ad2e6a230ad6c41d9db0737f505126
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e58466e.rbs
                            • Path C:\Config.Msi\e58466e.rbs
                            • Size 11KB
                            • SHA256 4ffc1d5e9d6512d95a9bb2fd49f8e4efc87a3497ca614281a21fbfd3875dc61c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e584673.rbs
                            • Path C:\Config.Msi\e584673.rbs
                            • Size 8KB
                            • SHA256 d543abbb4734862a6e1d685345d598329304679a2830f68ea2343e1b4e021821
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e584674.rbf
                            • Path C:\Config.Msi\e584674.rbf
                            • Size 143KB
                            • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e584675.rbf
                            • Path C:\Config.Msi\e584675.rbf
                            • Size 3B
                            • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                            • MD5 SHA1 SHA512
                            Submit Download

                            e584678.rbs
                            • Path C:\Config.Msi\e584678.rbs
                            • Size 3KB
                            • SHA256 c256a3a9788ee617c41dd03c58194c1beee6237a7eae962c0749f571c6407fd8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e58467c.rbs
                            • Path C:\Config.Msi\e58467c.rbs
                            • Size 87KB
                            • SHA256 7985c9ab8bc1500b9dbf4617c903754f9fa5ff2a2f7a19b2d32d3e9934d5ea97
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e584680.rbs
                            • Path C:\Config.Msi\e584680.rbs
                            • Size 3KB
                            • SHA256 8ecc812e640fb1a242c52b66f95a8b4bc5fb2d2f77e7ff8ecc29aa48988ff511
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            e584683.rbs
                            • Path C:\Config.Msi\e584683.rbs
                            • Size 132KB
                            • SHA256 7d0edd2b6bf66607bede67b704f1b3b5f5da675e742da0b660313b11abbeb561
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e5847a0.rbs
                            • Path C:\Config.Msi\e5847a0.rbs
                            • Size 8KB
                            • SHA256 a32974ba1e3769f62f569f806abcc17cb9b08b792f8b10c5893f36196024e59b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            e5847a4.rbs
                            • Path C:\Config.Msi\e5847a4.rbs
                            • Size 86KB
                            • SHA256 0e5711c969da77c39c5ec920948937ccf36f4274b907e9f09c8e8ef93ca80a1f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            manifest.fingerprint
                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3008_659850878\manifest.fingerprint
                            • Size 66B
                            • SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3008_659850878\manifest.json
                            • Size 135B
                            • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            state.rsm
                            • Path C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\state.rsm
                            • Size 1022B
                            • SHA256 9e98fce10bcf33728e02e8da600606b60280be285ce8284fb64742aa14309e4c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            powershell.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            • Size 2KB
                            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 4ee75b9bd85c06e1b58c54155ab27230c46345559d353fb0582a9592839432f1
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 a37f0c405cb869d3b94ec44f1de7b378f171244ef28804afd26e557adcb85a64
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 5be50eeaf61848a4e77b6b973505ef16d33696290db10cca16d146bc432b9606
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 dc20c1cf6a1f6cdfb6710c236cfd1a7a15370e85239f5f004f7fa75b678a2e79
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 96d29d272f8c8d1b2dd50d6c9291dcdb0e47343e8e0b50fc48fc24ade60dd7ae
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 d04ae946225b4b363148708167ade85c76bf65aef513e999de44ae6628de0566
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RedBooster.exe
                            • Path C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe
                            • Size 16.5MB
                            • SHA256 d57f746eaf9b8d5e650ecfd981edf3700189b72efd8daabbee4700ba9e6ec85f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            .hwidlock
                            • Path C:\Users\Admin\AppData\Local\RedBooster\.hwidlock
                            • Size 374B
                            • SHA256 35de046ac53c0681ade8b569629e677321c004e30e239fd07eb8d3ef2768f229
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prefs.json
                            • Path C:\Users\Admin\AppData\Local\RedBooster\prefs.json
                            • Size 59B
                            • SHA256 d9bbe7c7c7293d4908c88cbbbb6198af560bc79bd8d8205e4062340426b098c8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prefs.json
                            • Path C:\Users\Admin\AppData\Local\RedBooster\prefs.json
                            • Size 85B
                            • SHA256 7f532e610a4e28af118fbe94f030ab1c886656612d0243eeb2144354bcb855f8
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.json
                            • Path C:\Users\Admin\AppData\Local\RedBooster\settings.json
                            • Size 1KB
                            • SHA256 3522a7321f563ead542fe781144cb080086f5dde32438af672df0cac1a791a55
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            protocols.json
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                            • Size 3KB
                            • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 47ee1f68e24f36f4ca4755f0c9f9356609e3a729719fec068212b28bdf517711
                            • MD5 SHA1 SHA512
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 2436bc4bf99f6304b12c5956000ee59990fbc3d9adbd826abca244c68fc1eec7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            throttle_store.dat
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\throttle_store.dat
                            • Size 20B
                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                            • MD5 SHA1 SHA512
                            Submit Download

                            the-real-index
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 120B
                            • SHA256 15f2ab9d708f6b77cf8160c28336b59dff9ac7b3690808837417d1d9fff2671b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            the-real-index~RFe58d136.TMP
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d136.TMP
                            • Size 48B
                            • SHA256 adfde4d690518a3506cff68d921bc24a47aa7c13b1e890a583da90a48b0aec2d
                            • MD5 SHA1 SHA512
                            Submit Download

                            data_0
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\DawnWebGPUCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\DawnWebGPUCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_2
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\DawnWebGPUCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_3
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\DawnWebGPUCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MANIFEST-000001
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            Network Persistent State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\Network Persistent State
                            • Size 111B
                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Network Persistent State~RFe5989a8.TMP
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\Network Persistent State~RFe5989a8.TMP
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 ea88e35e0e8387430761a545b231454f57946fa19e006a98a28aaa6d6707fc6c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Preferences~RFe58fb91.TMP
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Preferences~RFe58fb91.TMP
                            • Size 6KB
                            • SHA256 c10c2ca13d458643ef6f69f91d67425e22ff202f044f7ba3eabe84b9ea6b146b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CURRENT
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Site Characteristics Database\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 16KB
                            • SHA256 f5d8347367f4074d9ca324ee8bb37d4195eb1f0e4b123b75ae0f4849cea3f136
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 1KB
                            • SHA256 a364ddb9c7729c43f85e04fc77f6d8551992353bef27d6bd0f1b118e41c5817e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 2KB
                            • SHA256 1aeddbcb8564d8ceb6aab31424854282c775773b5bfcc31b6a5de01c660684a5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 3KB
                            • SHA256 6fb46ebe84d27349568e9908b72072f1d37077e9d278bad5b35b6cf9f3832d57
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 16KB
                            • SHA256 9effdcc3ac11c006a27b50ad307a51ab4fd60e162bbe98875fb68e22b6635ec1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 17KB
                            • SHA256 de3d7cd8dfc9d7a8ea8f99752d3955b26715e602debd921818003d9f7aa60bd0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                            • Size 4KB
                            • SHA256 9c6ca64894880e5ed41526bec16a3b26f2112b633f99d54bb9f932db36552228
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Local State~RFe585c34.TMP
                            • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State~RFe585c34.TMP
                            • Size 1KB
                            • SHA256 d208065b28829608df65e587b079d38cc68baf26489c8b0199ce125c76a268d0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_000_dotnet_runtime_8.0.28_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_000_dotnet_runtime_8.0.28_win_x64.msi.log
                            • Size 2KB
                            • SHA256 d64a9627eb93ca510ed496f46fc691fc920f1f4e0a33ec1294f0b017691355ad
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_001_dotnet_hostfxr_8.0.28_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_001_dotnet_hostfxr_8.0.28_win_x64.msi.log
                            • Size 19KB
                            • SHA256 bfe8127098b5b604d4e83a7cf33fb4de5cfb0de0ae80de8ae604fd7a214c9cab
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_002_dotnet_host_8.0.28_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035211_002_dotnet_host_8.0.28_win_x64.msi.log
                            • Size 2KB
                            • SHA256 16f33a2e036295c1e20e86cee9840f6dee26d5b553bf0be5de76c6665c19fe75
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_rjnulfk2.3zm.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rjnulfk2.3zm.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RedBooster-Setup.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\is-YRJFMM3AJW.tmp\RedBooster-Setup.tmp
                            • Size 4.3MB
                            • SHA256 aaf88c4b1f822becd814d02330443cc73f552ab90c4f1d93084c48841d0e25b6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            MSI50EA.tmp
                            • Path C:\Windows\Installer\MSI50EA.tmp
                            • Size 219KB
                            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            thm.wxl
                            • Path C:\Windows\Temp\{2B2348FA-F9EE-489A-B27A-5EA258482DA1}\.ba\1033\thm.wxl
                            • Size 5KB
                            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            windowsdesktop-runtime-8-x64.exe
                            • Path C:\Windows\Temp\{7CB7DF98-C62D-4E54-BA85-1C3321B891E3}\.cr\windowsdesktop-runtime-8-x64.exe
                            • Size 607KB
                            • SHA256 783abfc08b33d96d46c83948d805a3b84c8b3d499022856496e21c40673c0ee2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            bg.png
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\.ba\bg.png
                            • Size 4KB
                            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wixstdba.dll
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\.ba\wixstdba.dll
                            • Size 190KB
                            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dotnet_host_8.0.28_win_x64.msi
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\dotnet_host_8.0.28_win_x64.msi
                            • Size 704KB
                            • SHA256 e368cbd51e46ba49b14975c858f3a6c6295890f438fbeb4e7a07b93a9b5bf00e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dotnet_hostfxr_8.0.28_win_x64.msi
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\dotnet_hostfxr_8.0.28_win_x64.msi
                            • Size 776KB
                            • SHA256 a2241bbfa9e412ed3e0a7bc63eab3b88421bfe8172432af9152ac84709443bc3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dotnet_runtime_8.0.28_win_x64.msi
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\dotnet_runtime_8.0.28_win_x64.msi
                            • Size 26.2MB
                            • SHA256 8e57991c99308ccc3f4ca5de726b9915bb379a1c903db61c0e28f257142da835
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            windowsdesktop_runtime_8.0.28_win_x64.msi
                            • Path C:\Windows\Temp\{87F526CA-F4EB-40D3-A597-D863C33CAA92}\windowsdesktop_runtime_8.0.28_win_x64.msi
                            • Size 28.9MB
                            • SHA256 167bbc995b57fec6a02beea16e607c2d4c95982384201710989c2b02fd8d1f97
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            thm.xml
                            • Path C:\Windows\Temp\{CDECE108-8A6F-4829-9933-673427877820}\.ba\thm.xml
                            • Size 11KB
                            • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/460-0-0x00000000001C0000-0x00000000002BC000-memory.dmp
                            Download

                            memory/460-24-0x00000000001C0000-0x00000000002BC000-memory.dmp
                            Download

                            memory/724-1602-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/724-1614-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/1016-240-0x00007FFC28D60000-0x00007FFC28D61000-memory.dmp
                            Download

                            memory/1476-422-0x00007FFC28D60000-0x00007FFC28D61000-memory.dmp
                            Download

                            memory/3508-5-0x0000000001280000-0x0000000001281000-memory.dmp
                            Download

                            memory/3508-25-0x00000000006C0000-0x0000000000B18000-memory.dmp
                            Download

                            memory/3508-27-0x0000000001280000-0x0000000001281000-memory.dmp
                            Download

                            memory/3508-1623-0x00000000006C0000-0x0000000000B18000-memory.dmp
                            Download

                            memory/4164-159-0x000001BDA61D0000-0x000001BDA61FA000-memory.dmp
                            Download

                            memory/4164-162-0x000001BDA6E50000-0x000001BDA7378000-memory.dmp
                            Download

                            memory/4164-161-0x000001BDA6750000-0x000001BDA6912000-memory.dmp
                            Download

                            memory/4164-160-0x000001BDA61D0000-0x000001BDA61F4000-memory.dmp
                            Download

                            memory/4164-152-0x000001BDA6030000-0x000001BDA6052000-memory.dmp
                            Download

                            memory/4404-593-0x000002766C9D0000-0x000002766C9DA000-memory.dmp
                            Download

                            memory/4404-589-0x000002766CC00000-0x000002766CC16000-memory.dmp
                            Download

                            memory/4404-597-0x000002766CC70000-0x000002766CC96000-memory.dmp
                            Download

                            memory/4448-166-0x000001E6EB120000-0x000001E6EB148000-memory.dmp
                            Download

                            memory/4856-1603-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/4856-1609-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/5608-1613-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/5608-1600-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/5928-321-0x00007FFC29220000-0x00007FFC29221000-memory.dmp
                            Download

                            memory/5928-325-0x00007FFC286A0000-0x00007FFC286A1000-memory.dmp
                            Download

                            memory/5980-1616-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/5980-1617-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/6324-1601-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/6556-1604-0x00000000000F0000-0x0000000000166000-memory.dmp
                            Download

                            memory/6932-1532-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1533-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1534-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1535-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1536-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1537-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1538-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1526-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1528-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download

                            memory/6932-1527-0x000002A6B5C60000-0x000002A6B5C61000-memory.dmp
                            Download